Data recovery method and electronic device

Abstract

This application discloses a data recovery method and electronic device, relating to the field of data processing technology and applied to a storage system. The method includes: in response to an abnormal write event, reading specified verification data from a first storage area via a control engine; reading at least one valid data block of data to be recovered from a second storage area via the control engine; performing data reconstruction on the at least one valid data block based on the specified verification data to obtain reconstructed data to be recovered, and sending feedback information to a computing node, wherein the feedback information instructs the computing node to read the reconstructed data to be recovered and write the reconstructed data to be recovered into a hard disk array. This application solves the problems of low data recovery efficiency and low security of verification data in existing data recovery methods, achieving the effect of improving data recovery efficiency and verifying data security.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data recovery method and an electronic device. Background Technology

[0002] In related technologies, data recovery typically relies on the host (such as a compute node) operating system to initiate an explicit reconstruction task. Verification data needs to be moved to host memory, processed by the CPU or coprocessor, and then written back to the hard disk. This recovery path is a lengthy I / O path, which not only introduces significant scheduling delays but also requires sensitive verification data to be transmitted through host memory or via the high-speed serial computer extended bus standard (Peripheral Component Interconnect Express, or PCIe) during the recovery process, thus exposing the data to the attack surface and making it vulnerable to interception or contamination.

[0003] Therefore, data recovery methods in related technologies suffer from low data recovery efficiency and low security of verified data. Summary of the Invention

[0004] This application provides a data recovery method and an electronic device to at least solve the problems of low data recovery efficiency and low security of verification data in related technologies.

[0005] This application provides a data recovery method applied to a storage system. The storage system includes a storage controller, compute nodes, and a hard disk array. The storage controller includes an isolation unit, a memory pool, and a control engine. The isolation unit is used to isolate the memory pool into a first storage area and a second storage area, thereby disconnecting the path between the compute node and the first storage area. The first storage area is used to store verification data, and the second storage area is used to store cached data of the compute node. The control engine is used to exclusively access the first storage area. The method includes: in response to an abnormal write event, reading specified verification data from the first storage area through the control engine, wherein the specified verification data is the verification data corresponding to the data to be recovered indicated by the abnormal write event; reading at least one valid data block of the data to be recovered from the second storage area through the control engine; performing data reconstruction on the at least one valid data block based on the specified verification data to obtain the reconstructed data to be recovered, and sending feedback information to the compute node, wherein the feedback information is used to instruct the compute node to read the reconstructed data to be recovered and write the reconstructed data to be recovered into the hard disk array.

[0006] This application also provides a storage system, which includes a storage controller, a compute node, and a hard disk array. The storage controller includes an isolation unit, a memory pool, and a control engine. The isolation unit is used to isolate the memory pool into a first storage area and a second storage area, thereby disconnecting the compute node from the first storage area. The first storage area is used to store verification data, and the second storage area is used to store cached data of the compute node. The control engine is used to exclusively access the first storage area.

[0007] The control engine is configured to, in response to an abnormal write event, read specified verification data from the first storage area, wherein the specified verification data is the verification data corresponding to the data to be recovered indicated by the abnormal write event; read at least one valid data block of the data to be recovered from the second storage area; perform data reconstruction on the at least one valid data block based on the specified verification data to obtain the reconstructed data to be recovered, and send feedback information to the computing node, wherein the feedback information is used to instruct the computing node to read the reconstructed data to be recovered so as to write the reconstructed data to be recovered into the hard disk array.

[0008] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above data recovery methods.

[0009] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described data recovery methods.

[0010] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described data recovery methods.

[0011] This application utilizes an isolation unit to isolate the memory pool into a first storage area and a second storage area, thereby disconnecting the path between the compute node and the first storage area. The control engine then exclusively accesses the first storage area. In response to an abnormal write event, the control engine reads specified verification data from the first storage area, where the specified verification data corresponds to the verification data to be recovered indicated by the abnormal write event. The control engine then reads at least one valid data block of the data to be recovered from the second storage area. Based on the specified verification data, data reconstruction is performed on the at least one valid data block to obtain the reconstructed data to be recovered. Feedback information is sent to the compute node to instruct it to read the reconstructed data to be recovered, and the reconstructed data to be recovered is then written to the hard disk array. By disconnecting the path between the compute node and the first storage area through the isolation unit, the verification data (first storage area) becomes invisible to the host and is exclusively accessed by the control engine. This fundamentally eliminates the potential data corruption risk caused by the verification data being exposed to host memory or transmitted via the PCIe bus, thus improving the security of the verification data. Furthermore, by deploying a control engine in the storage controller, the complexity of data recovery is reduced and the efficiency of data recovery is improved by bypassing the host (i.e., the compute node) and complex I / O paths. This solves the technical problems of low data recovery efficiency and low data security in related technologies, thus achieving the effect of improving data recovery efficiency and data security. Attached Figure Description

[0012] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a hardware structure block diagram of a data recovery method according to an embodiment of this application.

[0014] Figure 2 This is a flowchart illustrating an optional data recovery method according to an embodiment of this application.

[0015] Figure 3 This is a schematic diagram of an optional data recovery method according to an embodiment of this application.

[0016] Figure 4 This is a schematic diagram of another optional data recovery method according to an embodiment of this application.

[0017] Figure 5 This is a schematic diagram of another optional data recovery method according to an embodiment of this application.

[0018] Figure 6 This is a schematic diagram of another optional data recovery method according to an embodiment of this application.

[0019] Figure 7 This is a schematic diagram of another optional data recovery method according to an embodiment of this application.

[0020] Figure 8 This is a schematic diagram of another optional data recovery method according to an embodiment of this application.

[0021] Figure 9 This is a structural block diagram of an optional storage system according to an embodiment of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0023] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0024] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] The specific application environment architecture or specific hardware architecture on which the execution of the data recovery method depends is described here.

[0026] The methods and embodiments provided in this application can be executed on a server device or a similar computing device. Taking running on a server device as an example, Figure 1 This is a hardware structure block diagram of the data recovery method according to an embodiment of this application. Figure 1 As shown, the server device may include one or more ( Figure 1Only one is shown in the image. A processor 102 (which may include, but is not limited to, a central processing unit (CPU), microprocessor (MCU), or programmable logic device (FPGA), etc.) and a memory 104 for storing data are also shown. The server device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the server equipment described above. For example, the server equipment may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0027] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the data recovery method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thus implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to server devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0028] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider for the server device. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0029] This embodiment provides a data recovery method applied to a storage system. The storage system includes a storage controller, compute nodes, and a hard disk array. The storage controller includes an isolation unit, a memory pool, and a control engine. The isolation unit is used to isolate the memory pool into a first storage area and a second storage area, thereby disconnecting the path between the compute nodes and the first storage area. The first storage area is used to store verification data, and the second storage area is used to store cached data of the compute nodes. The control engine is used to exclusively access the first storage area. Figure 2 This is a flowchart of a data recovery method according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0030] Step S202: In response to the existence of an abnormal write event, the specified verification data is read from the first storage area through the control engine, wherein the specified verification data is the verification data corresponding to the data to be recovered indicated by the abnormal write event;

[0031] Step S204: Read at least one valid data block of the data to be recovered from the second storage area through the control engine;

[0032] Step S206: Based on the specified verification data, perform data reconstruction on at least one valid data block to obtain the reconstructed data to be recovered, and send feedback information to the computing node. The feedback information is used to instruct the computing node to read the reconstructed data to be recovered so as to write the reconstructed data to be recovered into the hard disk array.

[0033] The data recovery method in this embodiment can be applied to the field of data processing technology, and is especially suitable for storage scenarios with extremely high requirements for data reliability and low-latency recovery (such as AI training data storage, transaction record storage) and strict data privacy protection requirements.

[0034] In related technologies, data recovery typically relies on the host (such as a compute node) operating system to initiate an explicit reconstruction task. Verification data needs to be moved to the host memory, processed by the CPU or coprocessor, and then written back to the hard disk. This recovery path is a lengthy I / O path, which not only introduces significant scheduling delays but also requires sensitive verification data to be transmitted through the host memory or PCIe bus during the recovery process, thus exposing it to the attack surface and making it easy to be intercepted or contaminated.

[0035] Therefore, data recovery methods in related technologies suffer from low data recovery efficiency and low security of verified data.

[0036] To at least partially address the aforementioned technical problems, this embodiment uses an isolation unit to disconnect the path between the computing node and the first storage area. This makes the verification data (first storage area) invisible to the host and exclusively accessible by the control engine. This fundamentally eliminates the potential data contamination risk caused by verification data being exposed to host memory or transmitted via the PCIe bus, thus improving the security of the verification data. Furthermore, by deploying the control engine in the storage controller, the host (i.e., the computing node) and complex I / O paths are bypassed, reducing the complexity of data recovery and improving data recovery efficiency. This solves the technical problems of low data recovery efficiency and low verification data security in related technologies, achieving the effect of improving both data recovery efficiency and verification data security.

[0037] It should be noted that an abnormal write event refers to a trigger condition in the storage system that detects data inconsistency, such as the failure of a physical disk in the hard disk array, silent data errors, or a mismatch in the checksum hash detected by background inspection. For example, when writing cached data from a compute node to the hard disk array, an abnormal write event can be generated if an anomaly occurs, thereby triggering the data recovery process.

[0038] like Figure 3 As shown, the memory pool can include a first storage area and a second storage area, which are isolated from each other by an isolation unit. The memory pool can be Compute Express Link (CXL) memory, a type of non-volatile storage. The first storage area can also be called a RAID parity dedicated area, exclusively used by the control engine and invisible and inaccessible to compute nodes (such as the host). For example, if the storage controller is a Redundant Arrays of Independent Disks (RAID) card and the corresponding memory pool is a CXL cache, the CXL cache can be isolated into a first storage area and a second storage area using an isolation unit. The control engine, which can be a RAID engine, controls the first storage area.

[0039] The control engine can refer to a dedicated hardware processing unit within the storage controller, possessing independent computing capabilities and data path control logic. It performs tasks such as verification calculations, data reconstruction, and key derivation, without relying on the CPU within the compute nodes. The isolation unit refers to a hardware logic circuit module configured between the control engine and the memory pool. This module may include address decoders, fuse-gated arrays, chip select interlock logic, etc., used to physically isolate the host access path from the engine access path, ensuring that compute nodes cannot directly address the verification data in the first storage area. It should be noted that there can be multiple compute nodes in the storage system, and each compute node can be understood as a host.

[0040] Optionally, in response to a write exception event, the verification data corresponding to the data to be recovered, i.e., the specified verification data, can be retrieved from the first storage area. Specifically, after detecting an abnormal write event, the control engine can access the first storage area through a dedicated internal data path (such as a private direct bus or a hardware-isolated read-only bypass) to locate and read the verification data corresponding to the abnormal data block. During this process, no CPU intervention from the compute node is involved, and due to the physical isolation properties of the first storage area, this read operation is performed entirely within a closed loop inside the controller, ensuring the security of the verification data.

[0041] Optionally, to further ensure the security of the verification data, it can be encrypted. Specifically, the verification data can be encrypted using a preset encryption method. This encryption method can be generated based on a specific hardware serial number in the isolation unit, or it can be generated based on the partition mask of the current first storage area.

[0042] It should be noted that the second storage area can be the storage area of ​​the compute node, which is an area in the memory pool that is visible and managed by the operating system of the compute node, and is used to store normal business data and cached data.

[0043] A valid data block can refer to the portion of data in the same data stripe that is not damaged when an anomaly occurs (such as disk failure), and can also be called a surviving data block.

[0044] Optionally, the control engine determines which data blocks need to be read from the second storage area based on the stripe information indicated by the abnormal write event. Since the second storage area is open to the compute nodes, the control engine needs to obtain the data through read requests issued by the isolation unit. The isolation unit verifies whether the requested address falls within the mask range that the engine is allowed to read. If valid, the data is transferred from the second storage area to the control engine through the designated read-only bus.

[0045] Optionally, after verifying the validity of the read request based on a preset read-only address mask, the isolation unit sends these valid data blocks into the input buffer register of the control engine through an internal data path. During this process, the control engine ensures that it only reads data and does not perform any write operations to prevent interference with the normal operation of the computing node.

[0046] It should be noted that data reconstruction can refer to the mathematical inverse operation of a preset algorithm, which is the process of calculating lost or corrupted data blocks by examining the data and at least one valid data block. The preset algorithm can refer to erasure coding algorithms (such as Exclusive OR or Reed-Solomon).

[0047] Feedback information may include the address, length, and validity period of the data to be recovered after reconstruction in the controller's internal temporary storage area (such as engine static random access memory, or SRAM), rather than the data itself.

[0048] Optionally, the control engine can include a computing unit. This computing unit performs a reconstruction operation to obtain the reconstructed data to be recovered. The control engine then performs an integrity self-check (such as a hash comparison). After confirming the data is correct, the engine temporarily stores the result in the storage controller, generates feedback information, and sends it to the computing node. This feedback information can be sent to the computing node through management channels such as CXL.io.

[0049] Optionally, to ensure data reconstruction efficiency, data reconstruction can be completed within a preset number of clock cycles.

[0050] According to the embodiments provided in this application, an isolation unit is used to isolate the memory pool into a first storage area and a second storage area, thereby disconnecting the path between the compute node and the first storage area. A control engine is used to exclusively access the first storage area. In response to an abnormal write event, the control engine reads specified verification data from the first storage area, wherein the specified verification data is the verification data corresponding to the data to be recovered indicated by the abnormal write event. The control engine reads at least one valid data block of the data to be recovered from the second storage area. Based on the specified verification data, data reconstruction is performed on at least one valid data block to obtain the reconstructed data to be recovered, and feedback information is sent to the compute node to instruct the compute node to read the reconstructed data to be recovered, thereby writing the reconstructed data to be recovered into the hard disk array. By disconnecting the path between the compute node and the first storage area through the isolation unit, the verification data (first storage area) is invisible to the host and exclusively accessed by the control engine, fundamentally eliminating the potential data corruption risk caused by the verification data being exposed to host memory or transmitted via the PCIe bus, thus improving the security of the verification data. Furthermore, by deploying a control engine in the storage controller, the complexity of data recovery is reduced and the efficiency of data recovery is improved by bypassing the host (i.e., the compute node) and complex I / O paths. This solves the technical problems of low data recovery efficiency and low data security in related technologies, thus achieving the effect of improving data recovery efficiency and data security.

[0051] In an exemplary embodiment, the verification data in the first storage area is encrypted data. Reading the specified verification data from the first storage area through the control engine includes: obtaining a preset hardware serial number and the current address mask of the first storage area; determining the current key sequence based on the preset hardware serial number and the current address mask of the first storage area; reading the specified verification data to be decrypted from the first storage area through the control engine; and decrypting the specified verification data to be decrypted based on the current key sequence to obtain the specified verification data.

[0052] It should be noted that the verification data in the first storage area is stored in encrypted form. Before the control engine can retrieve the specified verification data, it needs to determine the current key sequence. It can then retrieve the specified verification data in plaintext.

[0053] Optionally, the current key sequence can be determined by obtaining the current address mask and the preset hardware serial number of the first storage area. The preset hardware serial number refers to the unique identifier when the device is produced and burned, while the current address mask is a parameter that dynamically reflects the logical address mapping relationship of the first storage area.

[0054] Optionally, after determining the current key sequence, the control engine can decrypt the specified verification data to be decrypted read from the first storage area to obtain usable specified verification data. This process ensures that only the control engine with legitimate hardware identity and in the correct configuration state can generate the correct key to restore the data. Any attempt to clone the hardware or tamper with the address mask will result in a key derivation error, thus making it impossible to decrypt the data.

[0055] Optionally, the first and second storage areas can be repartitioned based on the disk configuration of the hard disk array, thereby generating new address masks for the first and second storage areas. The address mask for the first storage area indicates the address range of the first storage area, and the address mask for the second storage area indicates the address range of the second storage area. After generating the new address mask for the first storage area, the verification data in the first storage area can be re-encrypted, or the historical address mask for the first storage area can be retained.

[0056] If the specified verification data cannot be obtained from the first storage area, it indicates that there may be a partition readjustment. In this case, the historical address mask of the first storage area can be obtained from the internal storage of the storage controller. Based on the historical address mask and the preset hardware serial number, the historical key sequence is determined. Based on the historical key sequence, the specified verification data to be decrypted is decrypted.

[0057] In one example, such as Figure 4As shown, the control engine uses a preset hardware serial number as the root key, which is a one-time programmable (OTP) fuse-fixed hardware unique key (HUK). This root key is non-derivative and permanently fixed. Simultaneously, the control engine obtains the current address mask of the first storage area from an isolation unit (such as the CXL address domain boundary latch group). Subsequently, the key derivation function module within the control engine (such as a Hash-based Message Authentication Code (HMAC) or Secure Hash Algorithm 256-bit (SHA-256) circuit) uses the hardware unique key and the current address mask as input factors. Within a preset clock cycle, it derives the current data encryption key, i.e., the current key sequence, through combinational logic operations. Based on this current key sequence, verification data is written and read. The first storage area can store the encrypted verification data.

[0058] Optionally, to further ensure the security of the verification data, a temporary random number can be generated by the control engine. This temporary random number, a preset hardware serial number, and the current address mask of the first storage area are combined to obtain extended input data. A hash operation is then performed on the extended input data to obtain the current key sequence. The temporary random number can be updated by the control engine according to a preset time period and trigger events. For example, a random number generator can be deployed in the control engine, triggering the generator to generate temporary random numbers based on the preset time period and trigger events, and writing them to the first storage area for retrieval when decryption is required. By using a dynamic random factor, the key can be different in each session, further improving the security of the verification data.

[0059] In this embodiment, the key sequence generated by the dual binding of the hardware identity indicated by the preset hardware serial number and the dynamically configured address mask significantly improves the security of verification data during exclusive access.

[0060] In an exemplary embodiment, determining the current key sequence based on a preset hardware serial number and the current address mask of the first storage area includes: preprocessing the preset hardware serial number and the current address mask of the first storage area to obtain data to be processed, wherein the preprocessing includes at least one of the following: data concatenation and padding; performing a hash operation on the data to be processed to obtain the current key sequence.

[0061] It should be noted that when generating the current key sequence based on the preset hardware serial number and the current address mask of the first storage area, the unique hardware identifier (preset hardware serial number) and the status parameter (current address mask) reflecting the real-time logical location of the storage area can be standardized first. For example, the serial number string can be concatenated with the mask value, or the data can be filled with data of a fixed length to form data to be processed with a uniform structure, so as to eliminate the hash operation deviation caused by data format problems.

[0062] Optionally, a key function module can be set up inside the control engine to perform hash operations. This key function module can be an HMAC or SHA-256 circuit implemented with pure combinational logic.

[0063] Optionally, the control engine uses the pre-processed preset hardware serial number and the pre-processed current address mask of the first memory area as two factors in an HMAC or SHA-256 hardware circuit. This circuit, composed of pure combinational logic, performs cryptographic hash operations on these two factors within a fixed clock cycle to derive a unique Data Encryption Key (DEK), i.e., the current key sequence, in real time. This process is deterministic; that is, the same preset hardware serial number and current address mask will inevitably produce the same DEK. The generated DEK is then directly input into the Advanced Encryption Standard (AES) decryption engine to decrypt the ciphertext verification data read from the first memory area.

[0064] In this embodiment, preprocessing can eliminate hash operation deviations caused by differences in data format. Furthermore, the key sequence generated by the dual binding of the hardware identity indicated by the preset hardware serial number and the dynamically configured address mask significantly improves the security of the verification data.

[0065] In one exemplary embodiment, reading at least one valid data block of data to be recovered from a second storage area by a control engine includes: issuing a read request to an isolation unit by the control engine, wherein the read request includes a specified address corresponding to at least one valid data block; identifying, by the isolation unit, whether the specified address is within the address range indicated by the current address mask of the second storage pool; and, in response to the specified address being within the address range indicated by the current address mask of the second storage pool, reading at least one valid data block from the second storage pool via a specified bus, wherein the specified bus is a configured bus that allows the control engine to perform data reading.

[0066] It should be noted that the second storage area is the portion of the memory pool mapped to the compute nodes for storing business data, cached data, and metadata related to the business data. The current address mask of the second storage area refers to the address boundary value set by the register group in the isolation unit and latched in real time by the latch. The current address mask of the second storage area can be used to define the physical address range of the second and first storage areas. The isolation unit can determine the ownership of the address in the read request based on the current address mask of the second storage area.

[0067] The designated bus is a configured bus that allows the control engine to read data. It can also be called a unidirectional read-only bypass bus, a dedicated data path originating from the control engine, passing through the isolation unit's discrimination logic, and connecting to the second memory area. This bus only allows the control engine to initiate read requests, and the read range is strictly limited by the address mask; it can also be configured to strictly prohibit write operations.

[0068] Optionally, the control engine sends a read request to the isolation unit. The latch group in the isolation unit extracts the physical address from the request, i.e., the specified address, and performs a hardware level comparison with the current address mask. If the specified address falls within the address range indicated by the current address mask of the second memory area, the control engine can further determine whether it has permission to read that area through the hardware interlock logic array and the fuse-type access blocking gating array in the isolation unit. After successful verification, at least one valid data block can be retrieved from the second memory area via the designated bus.

[0069] For example, the isolation unit can achieve physical isolation in four dimensions: address, data, control, and clock. At the address level, the isolation unit uses an address mask array to block the transmission of host address signals to the parity area, ensuring that host address signals cannot penetrate the isolation unit and be mapped to the parity area, thus eliminating the possibility of illegal addressing of the parity area (i.e., the first storage area) by the compute node. At the data level, a 64-bit independent data bus architecture can be adopted. This bus is only used to receive parity data from the RAID engine in one direction. The data bus of the compute node is physically and permanently disconnected from the data bus of the first storage area, preventing parity data from leaking to the compute node and avoiding accidental write pollution to the second storage area. At the control signal level, the first and second storage areas can be driven by independent chip select signals CS0 and CS1, respectively, and strict mutual exclusion can be achieved through hardware interlocking logic. The read / write and chip select signals of the first storage area are generated independently by the control engine and are completely decoupled from the control signals of the compute node. Even if an abnormal control pulse is issued, it cannot trigger any response from the first storage area, effectively preventing signal crosstalk and erroneous operations. At the clock level, the first memory area is equipped with an independent 100MHz dedicated clock source, which is physically isolated from the host clock source and does not share the host power domain, thus eliminating the risk of cross-domain data competition and timing conflicts caused by clock synchronization or power fluctuations.

[0070] This embodiment, by introducing access control logic based on address masks, not only clarifies the path for the control engine to read data from the shared second storage area, effectively preventing security risks caused by address out-of-bounds access or illegal access, but also ensures the security and accuracy of the data reading process when using cached data for reconstruction, thereby guaranteeing the smooth execution of the reconstruction task.

[0071] In one exemplary embodiment, data reconstruction is performed on at least one valid data block based on specified verification data to obtain reconstructed data to be recovered. This includes: determining the stripe number of the abnormal data and its relative position within the stripe number based on the abnormal logical block address indicated by the abnormal write event, wherein the abnormal logical block address is the logical block address of the abnormal data; aligning the specified verification data and at least one valid data block based on the relative position; and performing verification operations on the aligned specified verification data and the aligned at least one valid data block based on the level of the hard disk array to perform data reconstruction and obtain the reconstructed data to be recovered.

[0072] It should be noted that an abnormal write event can occur at the address of the logical block where the exception occurs, i.e., the abnormal logical address.

[0073] An error logical block address can refer to the linear address on a logical volume that identifies the erroneous data block in a storage system. A stripe number can refer to the number of a set of data blocks that divide the logical space into a fixed-size set (strip size). Each stripe contains data blocks from different physical disks. Relative position can refer to the offset or index order of a specific data block or parity block within the same stripe structure. For example, the relative arrangement order in a RAID 5 stripe.

[0074] Alignment refers to filling the fixed input register slots of the computation unit with the read specified checksum data and at least one valid data block according to their relative positions in the original stripe. This ensures that the data blocks involved in the computation are consistent with the expected stripe structure.

[0075] Checksum operations are used to reconstruct lost or corrupted data from redundant information. Generally, different checksum operation methods can be selected based on the array level within the hard disk array to perform data recovery.

[0076] Optionally, based on the hard disk array level, a verification operation is performed on the aligned specified parity data and at least one aligned valid data block to reconstruct the data and obtain the reconstructed data to be recovered. Specifically, the control engine identifies the level of the hard disk array configured in the current storage system (such as RAID 5 or RAID 6) and calls a specific verification algorithm that matches it (such as XOR operation or Reed-Solomon coding algorithm). The aligned parity data and the valid data block are used to perform reverse calculation to recover the missing or damaged data content.

[0077] Through this embodiment, by using logical address location, data block alignment, and hierarchical verification operations, the control engine can perform accurate data recovery based on different storage configurations.

[0078] In one exemplary embodiment, the control engine includes a first computing unit; based on the level of the hard disk array, it performs a verification operation on the aligned specified verification data and at least one aligned valid data block to reconstruct the data to be recovered, including: in response to the hard disk array level being a first preset level, the first computing unit performs an XOR operation on the aligned specified verification data and at least one aligned valid data block to obtain the reconstructed data to be recovered.

[0079] It should be noted that the first computing unit can refer to a hardware circuit used to perform basic logic operations (such as XOR operations). In this embodiment, the first computing unit can also be called an XOR operation unit, which is a parallel processing circuit composed of combinational logic that can complete bitwise XOR operations on multi-bit numbers (such as 64-bit, 128-bit, or wider bit widths) within one or more clock cycles.

[0080] The first preset level can refer to a specific redundancy level in a hard disk array, typically corresponding to a level where data can be recovered with just a single XOR operation. For example, a hard disk array might be RAID 5. XOR operation refers to a bitwise logical operation. Specifically, when a data block is lost, the lost data block can be directly calculated by performing an XOR operation on all remaining data blocks and the parity block, without the need for complex matrix inversion or division operations.

[0081] In this embodiment, by introducing a dedicated computing unit and optimizing it for XOR operation at a specific hard disk level, the computational path for data reconstruction is simplified, the overhead caused by instruction jumps and context switching is reduced, thereby improving data recovery efficiency.

[0082] In one exemplary embodiment, the control engine includes a second computing unit, which is a multi-stage pipeline unit. The specified verification data includes at least two verification blocks. Based on the level of the hard disk array, a verification operation is performed on the aligned specified verification data and at least one aligned valid data block to reconstruct the data and obtain the reconstructed data to be recovered. This includes: in response to the level of the hard disk array being a second preset level, the second computing unit performs at least one stage of pipeline calculation on at least two verification blocks and at least one valid data block to obtain the reconstructed data to be recovered. The at least one stage of pipeline calculation includes adjoint calculation.

[0083] It should be noted that the second computing unit can refer to the hardware module of the control engine used to execute complex erasure coding algorithms. Unlike the first computing unit, the second computing unit is a multi-stage pipelined unit. Through a multi-stage pipeline approach, multiple computing nodes can be processed in parallel, which is suitable for scenarios requiring complex finite field operations (such as Galois field multiplication and division). Specifically, complex mathematical operations are decomposed into multiple small, sequentially executed stages (such as decoding, inversion, multiplication, and accumulation). Each stage is completed within one clock cycle, and data flows between stages like a pipeline, thereby improving data processing efficiency.

[0084] The second preset level refers to the level of redundancy supported in the hard disk array, typically corresponding to RAID6. When the hard disk array is at the second preset level, the specified parity data includes at least two parity blocks, allowing it to tolerate the simultaneous failure of two disks in the array. Its data recovery algorithm is usually based on Reed-Solomon codes (RS) or other advanced erasure coding algorithms.

[0085] At least two parity blocks can refer to two independent parity data blocks (such as horizontal parity P and vertical parity Q in RAID6) that are calculated and stored in the hard disk array to provide dual redundancy protection.

[0086] At least one stage of pipelined computation includes adjoint computation, which refers to performing operations on the received data blocks (including surviving data blocks and parity blocks) and the parity check matrix to calculate the adjoint vector. The adjoint vector can be used to reflect whether errors exist in the data and the location and value of the errors. A full zero in the adjoint indicates that the data is error-free.

[0087] This embodiment effectively solves the problem of insufficient computing power caused by serial processing in multi-parity block scenarios by using a multi-stage pipeline parallel accompanying computing mechanism. It achieves a significant improvement in data reconstruction speed and an effective reduction in reconstruction latency, ensuring that the storage system can complete data recovery more quickly in the event of multi-disk failure or data anomaly.

[0088] In one exemplary embodiment, the second computing unit performs at least one stage of pipelined computation on at least two check blocks and at least one valid data block to obtain reconstructed data to be recovered. This includes: substituting at least two check blocks and at least one valid data block sequentially into a finite field through the second computing unit to perform adjoint calculations to obtain a set of adjoints; in response to the presence of a non-zero adjoint in the set of adjoints, constructing a system of linear equations based on the location index of the data to be recovered in the hard disk array and the set of adjoints; and performing finite field multiplication and finite field division operations on the system of linear equations to obtain the reconstructed data to be recovered.

[0089] It should be noted that a finite field can refer to the basic algebraic structure for mathematical operations using erasure codes (such as Reed-Solomon). In this embodiment, the finite field refers to the Galois field (GF). In this field, addition and multiplication operations are defined on a finite set of elements (e.g., 256 elements), and the result of the operation is still within this set. This is very suitable for hardware circuit implementation because each element can be represented by one byte (8 bits).

[0090] Syndrome calculation refers to a linear combination operation using a parity check matrix and received surviving data blocks. If the data is complete and error-free, the syndrome result is all zeros; if data loss or errors exist, the syndrome result will be non-zero, and the non-zero value contains information about the error location and error value. Through syndrome calculation, multiple values ​​can be obtained, i.e., a set of syndromes. For example, in a RAID 6 hard drive array, since there are at least two parity blocks, two main syndrome values ​​can be generated, which can form a mathematical feature vector describing the data corruption state.

[0091] Optionally, after performing the synergistic calculation, an error location polynomial solution can also be performed to determine whether the solution result is consistent with the location index of the data to be recovered in the hard disk array.

[0092] The location index of the data to be recovered in the hard disk array can refer to the logical location of the abnormal data (such as lost data) in the stripe of the hard disk array. For example, in a 6-disk stripe, if disk 1 and disk 4 are lost, their location indices are 1 and 4 respectively. Based on the logical block address, the specific index of the lost block can be located and determined.

[0093] Optionally, based on the location index of the data to be recovered in the hard disk array and a set of syndromes, a system of linear equations is constructed. This system of linear equations is used to solve for the unknowns (i.e., the lost data blocks) during decoding. Specifically, finite field multiplication and finite field division operations can be performed on the system of linear equations to obtain the reconstructed data to be recovered. The finite field multiplication and division operations are multiplication and division operations performed in a finite field. For example, they can be implemented using lookup tables (LUTs, such as logarithmic and antilogarithmic tables) or combinational logic circuits to replace time-consuming traditional division, ensuring both computational speed and determinism.

[0094] In this embodiment, by using the multi-stage pipeline structure of the second computing unit to perform adjoint computation and finite field operations sequentially, the high latency caused by bit-by-bit computation or serial decoding in complex multi-parity block scenarios can be avoided, thereby improving data recovery efficiency.

[0095] In an exemplary embodiment, after performing data reconstruction on at least one valid data block based on specified verification data to obtain reconstructed data to be recovered, the method further includes: performing hash calculation on the reconstructed data to be recovered to obtain a specified hash value of the reconstructed data to be recovered; comparing the specified hash value with the initial hash value corresponding to the data to be recovered; and determining that the reconstruction of the data to be recovered is successful in response to the specified hash value being the same as the initial hash value.

[0096] It should be noted that after obtaining the reconstructed data to be recovered, the control engine will verify the reconstructed data to determine whether the reconstruction of the data to be recovered was successful.

[0097] Optionally, the control engine performs mathematical operations on the reconstructed data blocks using a preset hash algorithm (such as SHA-256 or MD5) to extract the feature fingerprint of the reconstructed data to be recovered, i.e., the specified hash value.

[0098] The specified hash value is compared with the initial hash value corresponding to the data to be recovered. The initial hash value is the original characteristic value of the data to be recovered in its intact state, which is recorded in advance.

[0099] The successful reconstruction of the data to be recovered is determined when the specified hash value is the same as the initial hash value. This means that when the two are completely matched, it is confirmed that there were no bit flips, data truncation, or calculation logic errors in the reconstruction process, thus marking the recovery operation as validly completed.

[0100] Optionally, the first storage area may also store verification metadata, such as the initial hash value. If the specified hash value does not match the initial hash value, the reconstruction of the data to be recovered is deemed to have failed. If the number of failures exceeds a preset number, the data is marked as unrecoverable, and the data reconstruction is terminated.

[0101] Optionally, if the reconstruction of the data to be recovered is successful, the reconstructed data to be recovered can be stored in a designated storage area. This designated storage area can be located in the storage controller, specifically in the control engine, such as a dedicated SRAM in the control engine, which is generally not exposed to the outside.

[0102] Optionally, after confirming that the reconstruction of the data to be recovered is successful, the compute node can be notified through feedback information, such as sending the feedback information through CXL.io. The feedback information may include the stripe number, length, window address, and enabled window of the data to be recovered, etc.

[0103] This embodiment improves the reliability and security of data recovery in a storage system by verifying the consistency of the reconstructed data to be recovered before writing it back to the hard disk array.

[0104] In an exemplary embodiment, the storage controller further includes a designated storage area for storing the reconstructed data to be recovered; the feedback information includes a temporary storage address of the reconstructed data to be recovered in the designated storage area; after sending the feedback information to the computing node, the method further includes: based on the temporary storage address indicated by the feedback information, reading the reconstructed data to be recovered from the designated storage area through the computing node, and storing the reconstructed data to be recovered in the hard disk array.

[0105] It should be noted that the storage controller also has a designated storage area, which can be used to temporarily store data to be recovered after reconstruction.

[0106] The feedback information includes at least a temporary storage address, which means that after the control engine completes the reconstruction calculation and writes the data to the specified storage area, it no longer directly transmits the data content, but only sends control instructions containing the specific storage location of the data (i.e., the temporary storage address) to the computing node.

[0107] Based on feedback information, the compute node can read the reconstructed data to be recovered from the designated storage area and store the reconstructed data to the hard disk array. After storing the reconstructed data to the hard disk array, the compute node can also send a confirmation message to the control engine via CXL.io to inform the control engine that the data has been written to disk.

[0108] Optionally, after receiving the confirmation information, the control engine can record the data indicated by the confirmation information into the list to be verified. It can read the data from the hard disk array and perform hash comparison through a preset inspection cycle. If the comparison is successful, the recovery is marked as complete; otherwise, it is retried.

[0109] In one example, such as Figure 5 As shown, when the control engine is a RAID engine, the first storage area is connected via a private direct bus through the RAID engine, and the second storage area is connected via a one-way read-only bypass bus. After confirming that the data reconstruction is successful, the data is temporarily restored to the designated storage area, and the host (corresponding compute node) is notified through feedback information. The host can read the relevant data in the designated storage area through a designated window (such as the CXL.mem window) and write it to the first storage area and the hard disk array respectively. The hard disk array can read the data from the second storage area.

[0110] Optionally, after completing a data recovery process, the control engine can automatically clear the key sequence corresponding to the specified verification data in the data recovery process in the register.

[0111] In this embodiment, by using the temporary storage address indicated in the feedback information, redundant data copying between the control engine and the computing node can be avoided, reducing bus bandwidth usage and transmission delays in intermediate links, and improving data recovery efficiency.

[0112] In one exemplary embodiment, the storage controller further includes a timer; the method further includes: after sending feedback information to the computing node, starting the timer; and if the timer's duration exceeds a preset duration, controlling the clearing of the reconstructed data to be recovered in the designated storage area.

[0113] It should be noted that the storage controller may also include a timer. After the control engine completes data reconstruction and temporarily stores the reconstructed data to be recovered in a designated storage area, it sends feedback information to the compute node and immediately triggers the timer to start accumulating time. If the timer's duration exceeds a preset duration, the controller will clear the reconstructed data to be recovered from the designated storage area, avoiding long-term occupation of storage in the storage controller. The preset duration can be determined based on the sum of network transmission latency, host driver response time, and the longest estimated time required for data to be written back from the control engine's SRAM to the host memory and further written to the hard drive.

[0114] This embodiment, by introducing an automatic clearing method for timers, enables closed-loop management of the lifecycle of temporarily reconstructed data, effectively avoiding redundant storage space occupation caused by write delays or failures of computing nodes, and improving the utilization rate of storage controller memory resources.

[0115] In one exemplary embodiment, the method further includes: in response to a specified change event, determining the storage capacity of a first storage area based on the array parameters of the hard disk array indicated by the specified change event, wherein the specified change event is an event in which the number of available hard disks in the hard disk array changes; determining the starting address of the first storage area based on the ending address indicated by the isolation unit and the storage space size of the first storage area, wherein the starting address of the first storage area and the ending address indicated by the isolation unit constitute the current address mask of the first storage area; and determining the current address mask of a second storage area based on the address information of the memory pool and the current address mask of the first storage area.

[0116] It should be noted that the specified change event can refer to an event triggered in the storage system where the configuration of the hard disk array is dynamically adjusted. Specifically, it can refer to a change in the number of available hard disks in the hard disk array, such as hot-swapping hard disks (adding disks), removing physical disks due to failure, or the administrator manually disbanding / reorganizing the RAID group.

[0117] Array parameters describe the current state of the hard disk array, including the total number of member disks (N), the number of data disks (D), the number of redundant disks, the array level (e.g., RAID 5 / 6), and the stripe size. Array parameters determine the total amount of parity data, thus determining the required capacity of the first storage area (parity-dedicated area).

[0118] Optionally, after determining the capacity of the first storage area, the starting address of the first storage area can be determined based on the ending address indicated by the isolation unit and the capacity of the first storage area, thereby determining the current address mask of the first storage area.

[0119] Optionally, after determining the current address mask of the first storage area, the current address mask of the second storage area can be determined based on the address information of the memory pool and the current address mask of the first storage area.

[0120] In this embodiment, the space ratio of the first storage area and the second storage area in the memory pool is dynamically adjusted according to the array parameters of the hard disk array, ensuring that the capacity of the isolation area used to store verification data always matches the redundancy requirements of the current hard disk array, thus avoiding the waste of idle memory space.

[0121] In an exemplary embodiment, the array parameters include the number of unused hard drives and the total number of disks in the hard disk array; determining the storage amount of the first storage area based on the array parameters of the hard disk array indicated by a specified change event includes: determining the base storage amount of the first storage area by multiplying the product of a specified coefficient and the total capacity of the memory pool, wherein the specified coefficient is the product of the ratio of the number of unused hard drives and the total number of disks in the hard disk array and a preset security coefficient; determining the specified compensation amount by multiplying the product of the ratio between the base storage amount of the first storage area and a preset hash calculation granularity and a preset hash value length; determining the intermediate storage amount of the first storage area by summing the specified compensation amount, the base storage amount of the first storage area, and the preset compensation amount; and aligning the intermediate storage amount of the first storage area based on a preset alignment granularity to obtain the storage amount of the first storage area, wherein the storage amount of the first storage area is an integer multiple of the preset alignment granularity.

[0122] It should be noted that the number of unused hard drives in a disk array can refer to the number of hard drives in the current disk array that are idle and available for expansion. In this embodiment, this is typically used to assess the system's redundancy potential or expansion capacity, thereby influencing the reservation strategy of the first storage area. The total number of disks represents the total number of physically connected hard drives in the disk array. The specified coefficient can be used to reflect the current proportion of redundancy capacity required by the storage system. The more unused disks there are, the more likely the system will need to be expanded or requires higher redundancy protection, thus requiring more parity space to be allocated.

[0123] The preset safety factor is usually a preset constant (such as 1.0, 1.1, etc.) used to add extra redundancy space on top of the basic calculation to cope with verification calculation errors, metadata overhead or extreme failure scenarios, and to ensure the absolute safety of verification data.

[0124] The preset hash calculation granularity controls the fixed data block size (e.g., 1MB) when the engine calculates data integrity hashes (e.g., SHA-256). For each granularity, a corresponding hash value needs to be stored for integrity verification.

[0125] The specified compensation amount can refer to the additional space required for storing checksum metadata (mainly integrity hash values). Its size depends on the base storage size of the first storage area and the preset hash calculation granularity. The preset compensation amount can refer to the fixed overhead space that cannot be omitted for storing other internal hardware states, checkpoints, bitmaps, or boundary magic numbers (such as a 1MB state area and a 256KB boundary magic number). The preset alignment granularity can refer to the minimum address alignment unit that the address decoder requires the partition boundary to meet (such as 64KB). This is to ensure the accuracy of the hardware mask logic and prevent routing errors caused by ambiguous address boundaries.

[0126] Specifically, the formula for calculating the storage capacity of the first storage area can be shown in the following formula (1):

[0127] (1)

[0128] in, This represents the storage capacity of the first storage area. This is the base storage capacity of the first storage area. The storage amount for the verification metadata in the first storage area; This is the preset hardware constraint capacity.

[0129] In a further step, the formula for calculating the storage capacity of the first storage area can be shown in the following formula (2):

[0130] (2)

[0131] in, This represents the total capacity of the memory pool. This represents the total number of hard drives in the hard drive array. This represents the number of hard drives currently in use within the hard drive array. The preset safety factor is generally greater than or equal to 1, and can be set based on fuses and registers. The rounding up symbol, This is the base storage capacity of the first storage area. To preset the hash calculation granularity, The number of bytes in a single hash value depends on the hash algorithm. This is the boundary magic number marker area, with 128KB at the beginning and end of the first memory area. It is used to verify partition integrity and prevent out-of-bounds access during power-on. This is the preset capacity of the engine state storage area, used to store runtime context such as reconstructed bitmaps and checkpoints. The bit width for checking calculations in the engine (e.g., 512bit / 1024bit) is set by a fixed register inside the engine. This is the maximum burst length of the bus. To align the fill amount.

[0132] It should be noted that the alignment padding is a meaningless placeholder space filled to meet the address mask alignment requirements. The isolation unit determines the memory access ownership through the address mask, requiring that the partition boundary must fall on an integer multiple of a specific alignment granularity (such as 64KB); otherwise, addresses near the boundary will be incorrectly classified.

[0133] To achieve further alignment, the alignment can be adjusted using the following formula (3) so that the storage capacity of the first storage area is an integer multiple of the preset alignment granularity:

[0134] (3)

[0135] in, The capacity of the first storage area after alignment adjustment can be set. Set the preset alignment granularity.

[0136] In one example, assuming a RAID 5 hard drive array with 4 disks and a CXL memory pool capacity of 4GB, the basic parity data requires 1GB, and the storage size of the parity metadata (hash, boundary markers, status area) in the first storage area is approximately 1.29MB; approximately 76KB of reserved space is used to meet burst transmission and alignment requirements. The total requirement is approximately the sum of 1GB and 1.37MB. After 64KB alignment, the final capacity of the parity area (corresponding to the first storage area) is approximately 1GB and 1.37MB, located in the high address space and physically isolated. The host area (corresponding to the second storage area) is correspondingly reduced to approximately 2.999GB. This mechanism ensures the accuracy of hardware logic determination while achieving secure isolation and dynamic space allocation between the parity area and the host area.

[0137] Through this embodiment, a multi-level calculation and mask generation mechanism based on array parameters, hash granularity, and alignment rules is used to achieve dynamic and precise allocation of verification data storage space. At the same time, the physical boundary between the first storage area and the second storage area is clearly defined by the address mask, which effectively avoids address space overlap or resource waste caused by dynamic adjustment, and ensures the exclusive access efficiency of the storage controller to the verification data and the read and write stability of the compute node cache data.

[0138] In one exemplary embodiment, the storage controller further includes a power-down protection circuit, and the method further includes: in response to a power-down event in the memory pool, supplying power to the first storage area through the power-down protection circuit.

[0139] It should be noted that when a power failure event is detected in the memory pool, the first storage area can be powered by the backup power supply (such as a capacitor) in the power failure protection circuit, and the isolation unit can be controlled to latch the address signal and data signal. After power-on, the verification data in the first storage area can be restored.

[0140] This embodiment effectively avoids the risk of data loss due to sudden power failure by using a power-loss protection circuit, ensuring the continuity and reliability of the data recovery process even under extreme operating conditions.

[0141] The data recovery method in this application embodiment will be explained below with reference to optional examples. In this optional example, such as Figure 6 As shown, when a decryption request exists (e.g., data needs to be recovered, or periodic self-checks are performed on the verification data), the key derivation factors (the hardware unique key HUK and the current address mask in the address latch of the isolation unit) can be obtained. These two factors are input into the key function module to generate the data encryption key DEK (corresponding to the current key sequence). The control engine also has a decryption unit, which reads the ciphertext of the verification area (verification data in the first storage area), bypasses a specific bus (such as the CXL bus) via a private direct connection bus to obtain the ciphertext of the verification area. The decryption unit (which may be configured with AES) uses the data encryption key to decrypt the ciphertext to obtain the plaintext verification data. The plaintext verification data is then decrypted by the first or second calculation unit, or by a hash comparison performed by the self-check module to perform an integrity self-check on the plaintext verification data. Finally, the plaintext is destroyed within a limited time, such as automatically cleaned up after a preset clock cycle, so that the plaintext is not directly stored.

[0142] In another example, such as Figure 7 As shown, the host (CPU) can initiate I / O requests and access the storage controller via the CXL protocol. This includes sending management commands (such as partition adjustments and key verification) via CXL.io. The storage controller is responsible for coordinating data interaction between the host and storage devices (disk arrays). This may include hardware isolation units, specifically... Figure 8 As shown.

[0143] The host area can be used as regular memory by the host and supports CXL cache consistency. The parity area is used to store parity data. The control engine is used to perform verification operations during data recovery, such as XOR / RS (Reed-Solomon) calculations, and is responsible for generating, reading, and resuming verification data calculations and integrity self-checks.

[0144] The storage device can be a back-end Non-Volatile Memory Express (NVMe) / CXL NVMe disk array for persistent storage of business data.

[0145] Specifically, such as Figure 8As shown, the host and storage controller can be connected via the CXL composite bus. The CXL composite bus includes a management module (such as CXL.io sideband management, used to manage channels, transmit configuration information and security key sequences (used to prevent the current address mask from being maliciously tampered with), an address / control module (such as CXL.mem address / control, used to manage access request addresses and control signals issued by the host), and a data module (such as CXL.mem 64-bit data, used to establish a data path between the host and the storage controller).

[0146] The isolation unit may include an address mask generation array, which may include an OTP fuse (factory-programmed, unalterable, used to define the end address of the first storage area) and a configuration register group. The management module receives the partition start address and partition size to determine the address mask of the host area and the address of the check area. During this process, the security key sequence must be verified before writing. The configuration register group is independently powered to ensure that the partition configuration is not lost when the CXL bus is powered off.

[0147] The isolation unit may also include an address domain boundary latch group, which can capture addresses issued by CXL.mem in real time and perform address comparisons (host address comparison and parity area address comparison) using address masks. Specifically, if the address falls within the host domain, an address hit is output; if the address falls within the parity area, a blocking control signal is output. Similarly, the address domain boundary latch group is independently powered and unaffected by the CXL power domain.

[0148] The isolation unit can also include a dual-domain independent clock phase isolation divider unit. The host domain clock is CLK-H (100MHz), derived from the CXL reference clock; the parity domain clock is CLK-R (100MHz), originating from CLK-H but out of phase by 180°. This prevents cross-domain crosstalk or clock injection attack windows caused by accidental synchronization between the two clock domains. Of course, as long as the two clocks do not overlap or synchronize, for example, they can be out of phase by 90°. Specifically, a phase comparator monitors these two clocks. Upon detecting phase synchronization (abnormal / crosstalk risk), an abnormal signal is output to forcibly pull CS1 (parity chip select) low, blocking access in terms of timing. Specifically, it can also include an interlocking logic array, which can be based on hardware mutual exclusion logic (such as NAND gates). CS0 (host chip select) and CS1 (parity chip select) are mutually exclusive to prevent CS0 and CS1 from being effective simultaneously, eliminating bus contention or false triggering.

[0149] The isolation unit may also include a fuse-based access blocking gating array. The fuse-based access blocking gating array includes a host path and a parity path. The host path S_H is always open to allow host data to flow normally to the host area. The parity path S_R is permanently fused at the factory. Even if an address comparison error occurs or CS1 is illegally pulled low, the physical bus is already open, and host data cannot reach the parity area.

[0150] The control engine, also known as the RAID engine, can consist of a data recovery controller, a verification calculation unit, and an integrity self-test module. The data recovery controller triggers the recovery logic. The verification calculation unit performs XOR / erasure coding operations. The integrity self-test module performs hash comparisons.

[0151] A proprietary direct-connect bus bypasses the isolation unit to directly read and write the verification area. This is the only legitimate hardware path for verification data to enter and exit, ensuring high bandwidth and low latency. A unidirectional read-only bypass bus can read data from the host area; this path is address-filtered by the isolation unit, allowing only read-only access and preventing the engine from writing illegal data back to the host area.

[0152] The host area can be connected to the S_H path, whose clock is CLK-H, making the host area visible, addressable, and accessible to the host.

[0153] The verification area can be connected to a private direct bus with a clock of CLK-R (inverted from CLK-H). The corresponding characteristics are that the host is invisible, unaddressable, and physically unreachable, while maintaining S_R fuse and physical open circuit.

[0154] Through the above architecture, during the configuration phase, the administrator sends the key sequence via CXL.io to update the software configuration register and generate a new Mask-A / Mask-B. During the host access phase, if the host accesses a valid address, the latch comparison passes, enabling S_H to conduct and allowing data to enter the host area. If the host attempts to access the checksum address, the latch comparison fails / output is blocked, causing S_R to fuse, physically blocking access and resulting in no response. During the control engine usage phase, the checksum area can be read and written directly via a private direct-connect bus (without going through the isolation unit, resulting in high efficiency). Data in the host area can be read only via a unidirectional bypass bus for computation, achieving host-unaware operation.

[0155] This optional example addresses technical issues in related technologies, such as limited computing power, slow reconstruction speed, long and high-latency I / O stacks, fixed resources that cannot be dynamically adjusted, and low security of verification data, by constructing a hardware physical isolation architecture based on a memory pool, i.e., an isolation unit. Specifically, by dividing the CXL memory pool into a verification area (corresponding to the first storage area) invisible to the host and a host area (corresponding to the second storage area), and by utilizing multi-layered hardware logic such as OTP fuses, address latches, clock phase isolation, chip select interlocks, and physical fuses, complete physical isolation of three paths (address, data, and control) is achieved, completely blocking the path for malicious host attacks to pollute and tamper with verification data. Simultaneously, a RAID engine is introduced, enabling direct reading and writing of the parity area via a proprietary direct-connect bus, and reading host data using a unidirectional read-only bypass bus. This achieves zero-copy processing of parity data without passing through host memory or consuming PCIe bandwidth, eliminating the tens of microseconds of latency and bandwidth contention caused by multiple data copies between Dynamic Random Access Memory (DRAM), the RAID On Chip / RAID Controller (ROC), and PCIe in traditional solutions, significantly improving I / O performance. Furthermore, by utilizing the CXL.io sideband channel combined with a secure key sequence to dynamically configure partition boundaries, the RAID resources (parity area / host area size) are dynamically and adaptively adjusted according to changes in the hard drive array topology (such as hot-swapping), solving the problems of low resource utilization and poor scalability.

[0156] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0157] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.

[0158] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0159] Embodiments of this application also provide a storage system. Figure 9 This is a structural block diagram of a storage system according to an embodiment of this application, such as... Figure 9 As shown, the system includes: a storage controller 902, a compute node 904, and a hard disk array 906. The storage controller 902 includes an isolation unit 9022, a memory pool (not shown in the figure), and a control engine 9024. The isolation unit 9022 is used to isolate the memory pool into a first storage area 9026 and a second storage area 9028, so that the path between the compute node and the first storage area is disconnected. The first storage area is used to store verification data, and the second storage area is used to store cached data of the compute node. The control engine is used to exclusively access the first storage area.

[0160] The control engine 9024 is used to respond to an abnormal write event by reading specified verification data from a first storage area, wherein the specified verification data is the verification data corresponding to the data to be recovered indicated by the abnormal write event; reading at least one valid data block of the data to be recovered from a second storage area; performing data reconstruction on at least one valid data block based on the specified verification data to obtain the reconstructed data to be recovered, and sending feedback information to the compute node, wherein the feedback information is used to instruct the compute node to read the reconstructed data to be recovered so as to write the reconstructed data to be recovered into the hard disk array.

[0161] It should be noted that the control engine 9024 in this embodiment can be used to execute steps S202 to S206 as described above.

[0162] According to the embodiments provided in this application, an isolation unit is used to isolate the memory pool into a first storage area and a second storage area, thereby disconnecting the path between the compute node and the first storage area. A control engine is used to exclusively access the first storage area. In response to an abnormal write event, the control engine reads specified verification data from the first storage area, wherein the specified verification data is the verification data corresponding to the data to be recovered indicated by the abnormal write event. The control engine reads at least one valid data block of the data to be recovered from the second storage area. Based on the specified verification data, data reconstruction is performed on at least one valid data block to obtain the reconstructed data to be recovered, and feedback information is sent to the compute node to instruct the compute node to read the reconstructed data to be recovered, thereby writing the reconstructed data to be recovered into the hard disk array. By disconnecting the path between the compute node and the first storage area through the isolation unit, the verification data (first storage area) is invisible to the host and exclusively accessed by the control engine, fundamentally eliminating the potential data corruption risk caused by the verification data being exposed to host memory or transmitted via the PCIe bus, thus improving the security of the verification data. Furthermore, by deploying a control engine in the storage controller, the complexity of data recovery is reduced and the efficiency of data recovery is improved by bypassing the host (i.e., the compute node) and complex I / O paths. This solves the technical problems of low data recovery efficiency and low data security in related technologies, thus achieving the effect of improving data recovery efficiency and data security.

[0163] In an exemplary embodiment, the verification data in the first storage area is encrypted data. The control engine is further configured to: obtain a preset hardware serial number and the current address mask of the first storage area; determine the current key sequence based on the preset hardware serial number and the current address mask of the first storage area; read the specified verification data to be decrypted from the first storage area through the control engine; and decrypt the specified verification data to be decrypted based on the current key sequence to obtain the specified verification data.

[0164] In an exemplary embodiment, the control engine is further configured to: preprocess the preset hardware serial number and the current address mask of the first storage area to obtain data to be processed, wherein the preprocessing includes at least one of the following: data concatenation and padding; and perform a hash operation on the data to be processed to obtain the current key sequence.

[0165] In one exemplary embodiment, the control engine is further configured to: issue a read request to the isolation unit, wherein the read request includes a specified address corresponding to at least one valid data block;

[0166] The isolation unit is also used to identify whether a specified address is within the address range indicated by the current address mask of the second storage pool;

[0167] The control engine is also configured to: read at least one valid data block from the second memory pool via a specified bus in response to the specified address being in the address range indicated by the current address mask of the second memory pool, wherein the specified bus is a configured bus that allows the control engine to read data.

[0168] In one exemplary embodiment, the control engine is further configured to: determine the stripe number of the abnormal data and its relative position within the stripe number of the abnormal data based on the abnormal logical block address indicated by the abnormal write event, wherein the abnormal logical block address is the logical block address of the abnormal data; align specified check data and at least one valid data block based on the relative position; and perform a check operation on the aligned specified check data and at least one aligned valid data block based on the level of the hard disk array to perform data reconstruction and obtain the reconstructed data to be recovered.

[0169] In one exemplary embodiment, the control engine includes a first computing unit; the first computing unit is configured to, in response to the hard disk array being at a first preset level, perform an XOR operation on the aligned specified check data and at least one aligned valid data block to obtain the reconstructed data to be recovered.

[0170] In one exemplary embodiment, the control engine includes a second computing unit, which is a multi-stage pipeline unit, and the specified verification data includes at least two verification blocks;

[0171] The second computing unit is configured to perform at least one pipelined computation on at least two check blocks and at least one valid data block in response to the hard disk array being at a second preset level, in order to obtain the reconstructed data to be recovered, wherein the at least one pipelined computation includes adjoint computation.

[0172] In an exemplary embodiment, the second computing unit is further configured to sequentially substitute at least two check blocks and at least one valid data block into a finite field to perform adjoint calculations to obtain a set of adjoints; in response to the presence of a non-zero adjoint in the set of adjoints, construct a system of linear equations based on the location index of the data to be recovered in the hard disk array and the set of adjoints; and perform finite field multiplication and finite field division operations on the system of linear equations to obtain the reconstructed data to be recovered.

[0173] In one exemplary embodiment, the control engine is further configured to perform a hash calculation on the reconstructed data to be recovered after performing data reconstruction on at least one valid data block based on specified verification data to obtain reconstructed data to be recovered, to obtain a specified hash value of the reconstructed data to be recovered; to compare the specified hash value with the initial hash value corresponding to the data to be recovered; and to determine that the reconstruction of the data to be recovered is successful in response to the specified hash value being the same as the initial hash value.

[0174] In one exemplary embodiment, the storage controller further includes a designated storage area for storing the reconstructed data to be recovered; the feedback information includes the temporary storage address of the reconstructed data to be recovered in the designated storage area;

[0175] The compute node is used to read the reconstructed data to be recovered from the specified storage area based on the temporary storage address indicated by the feedback information after sending feedback information to the compute node, and to store the reconstructed data to be recovered in the hard disk array.

[0176] In one exemplary embodiment, the storage controller further includes a timer; a control engine is also configured to start the timer after sending feedback information to the computing node; and, if the timer's duration exceeds a preset duration, to clear the reconstructed data to be recovered in a specified storage area.

[0177] In one exemplary embodiment, the control engine is further configured to, in response to a specified change event, determine the storage capacity of a first storage area based on the array parameters of the hard disk array indicated by the specified change event, wherein the specified change event is an event in which the number of available hard disks in the hard disk array changes; determine the starting address of the first storage area based on the ending address indicated by the isolation unit and the storage space size of the first storage area, wherein the starting address of the first storage area and the ending address indicated by the isolation unit constitute the current address mask of the first storage area; and determine the current address mask of a second storage area based on the address information of the memory pool and the current address mask of the first storage area.

[0178] In one exemplary embodiment, the array parameters include the number of unused hard drives and the total number of disks in the hard drive array;

[0179] The control engine is also used to determine the base storage amount of the first storage area by multiplying a specified coefficient by the total capacity of the memory pool, where the specified coefficient is the product of the ratio of the number of unused hard drives in the hard disk array to the total number of disks and a preset security coefficient; to determine the specified compensation amount by multiplying the product of the ratio between the base storage amount of the first storage area and the preset hash calculation granularity and the preset hash value length; to determine the intermediate storage amount of the first storage area by summing the specified compensation amount, the base storage amount of the first storage area, and the preset compensation amount; and to align the intermediate storage amount of the first storage area based on the preset alignment granularity to obtain the storage amount of the first storage area, where the storage amount of the first storage area is an integer multiple of the preset alignment granularity.

[0180] In one exemplary embodiment, the storage controller further includes a power-down protection circuit, which is also configured to supply power to the first storage area in response to a power-down event in the memory pool.

[0181] For a description of the features in the embodiment corresponding to the storage system, please refer to the relevant description in the embodiment corresponding to the data recovery method, which will not be repeated here.

[0182] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above-described data recovery method embodiments.

[0183] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described data recovery method embodiments when it is run.

[0184] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0185] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described data recovery method embodiments.

[0186] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described data recovery method embodiments.

[0187] Any of the components, modules, units, parts, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Alternatively or additionally, any functionality described herein can be executed at least in part by one or more hardware logic components, such as, but not limited to, a central processing unit (CPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-a-chip (SoC), a complex programmable logic device (CPLD), a microprocessor (MCU), etc. The terms "system," "computing device," or "apparatus" as used herein encompass various means, devices, and machines for processing data, including, for example, one or more programmable processors, computers, SoCs, or combinations thereof. The apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or one or more combinations thereof. The aforementioned computer program (also known as a program, software, software application, app, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for a computing environment.

[0188] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0189] The data recovery method and electronic device provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A data recovery method characterized by, The invention is applied to a storage system, which includes a storage controller, compute nodes, and a hard disk array. The storage controller includes an isolation unit, a memory pool, and a control engine. The isolation unit is used to isolate the memory pool into a first storage area and a second storage area, thereby disconnecting the path between the compute node and the first storage area. The first storage area is used to store verification data, and the second storage area is used to store cached data of the compute node. The control engine is used for exclusive access to the first storage area; the method includes: In response to an abnormal write event, the control engine reads specified verification data from the first storage area, wherein the specified verification data is the verification data corresponding to the data to be recovered indicated by the abnormal write event; The control engine reads at least one valid data block of the data to be recovered from the second storage area. Based on the specified verification data, data reconstruction is performed on the at least one valid data block to obtain the reconstructed data to be recovered, and feedback information is sent to the computing node, wherein the feedback information is used to instruct the computing node to read the reconstructed data to be recovered so as to write the reconstructed data to be recovered into the hard disk array.

2. The method of claim 1, wherein, The verification data in the first storage area is encrypted data. The step of reading the specified verification data from the first storage area via the control engine includes: Obtain the preset hardware serial number and the current address mask of the first storage area; Based on the preset hardware serial number and the current address mask of the first storage area, the current key sequence is determined; The control engine reads the specified verification data to be decrypted from the first storage area. Based on the current key sequence, the specified verification data to be decrypted is decrypted to obtain the specified verification data.

3. The method according to claim 2, characterized in that, The step of determining the current key sequence based on the preset hardware serial number and the current address mask of the first storage area includes: The preset hardware serial number and the current address mask of the first storage area are preprocessed to obtain the data to be processed, wherein the preprocessing includes at least one of the following: data concatenation and padding. The data to be processed is hashed to obtain the current key sequence.

4. The method according to claim 1, characterized in that, The step of reading at least one valid data block of the data to be recovered from the second storage area through the control engine includes: The control engine sends a read request to the isolation unit, wherein the read request includes a specified address corresponding to the at least one valid data block; The isolation unit identifies whether the specified address is within the address range indicated by the current address mask of the second storage pool. In response to the specified address being within the address range indicated by the current address mask of the second storage pool, the at least one valid data block is read from the second storage pool via a specified bus, wherein the specified bus is a configured bus that allows the control engine to read data.

5. The method according to claim 1, characterized in that, The step of performing data reconstruction on the at least one valid data block based on the specified verification data to obtain the reconstructed data to be recovered includes: Based on the abnormal logical block address indicated by the abnormal write event, the stripe number where the abnormal data is located and its relative position within the stripe number where the abnormal data is located are determined, wherein the abnormal logical block address is the logical block address of the abnormal data. Based on the relative position, the specified verification data and the at least one valid data block are aligned; Based on the level of the hard disk array, a verification operation is performed on the aligned specified verification data and the aligned at least one valid data block to reconstruct the data and obtain the reconstructed data to be recovered.

6. The method according to claim 5, characterized in that, The control engine includes a first computing unit; based on the level of the hard disk array, it performs verification operations on the aligned specified verification data and the aligned at least one valid data block to reconstruct the data to be recovered, including: In response to the hard disk array being at a first preset level, the first computing unit performs an XOR operation on the aligned specified check data and the aligned at least one valid data block to obtain the reconstructed data to be recovered.

7. The method according to claim 5, characterized in that, The control engine includes a second computing unit, which is a multi-stage pipeline unit, and the specified verification data includes at least two verification blocks. Based on the level of the hard disk array, a verification operation is performed on the aligned specified verification data and the aligned at least one valid data block to reconstruct the data, resulting in the reconstructed data to be recovered, including: In response to the hard disk array being at a second preset level, the second computing unit performs at least one level of pipelined computation on the at least two check blocks and the at least one valid data block to obtain the reconstructed data to be recovered, wherein the at least one level of pipelined computation includes adjoint computation.

8. The method according to claim 7, characterized in that, The step of performing at least one stage of pipelined computation on the at least two check blocks and the at least one valid data block through the second computing unit to obtain the reconstructed data to be recovered includes: The second calculation unit sequentially substitutes the at least two check blocks and the at least one valid data block into the finite field to perform the adjoint calculation, thereby obtaining a set of adjoint expressions. In response to the presence of a non-zero syndrome in the set of syndromes, a system of linear equations is constructed based on the location index of the data to be recovered in the hard disk array and the set of syndromes. Finite field multiplication and finite field division operations are performed on the linear equation system to obtain the reconstructed data to be recovered.

9. The method according to any one of claims 1 to 8, characterized in that, After performing data reconstruction on the at least one valid data block based on the specified verification data to obtain the reconstructed data to be recovered, the method further includes: Perform a hash calculation on the reconstructed data to be recovered to obtain a specified hash value of the reconstructed data to be recovered. Compare the specified hash value with the initial hash value corresponding to the data to be recovered; In response to the specified hash value being the same as the initial hash value, it is determined that the reconstruction of the data to be recovered was successful.

10. The method according to any one of claims 1 to 8, characterized in that, The storage controller further includes a designated storage area for storing the reconstructed data to be recovered; the feedback information includes the temporary storage address of the reconstructed data to be recovered in the designated storage area. After sending feedback information to the computing node, the method further includes: Based on the temporary storage address indicated by the feedback information, the reconstructed data to be recovered is read from the designated storage area through the computing node, and the reconstructed data to be recovered is stored in the hard disk array.

11. The method according to claim 10, characterized in that, The storage controller further includes a timer; the method further includes: After sending feedback information to the computing node, the timer is started; If the duration of the timer exceeds the preset duration, the reconstructed data to be recovered in the designated storage area will be cleared.

12. The method according to any one of claims 1 to 8, characterized in that, The method further includes: In response to a specified change event, the storage capacity of the first storage area is determined based on the array parameters of the hard disk array indicated by the specified change event, wherein the specified change event is an event in which the number of available hard disks in the hard disk array changes; Based on the end address indicated by the isolation unit and the storage space size of the first storage area, the start address of the first storage area is determined, wherein the start address of the first storage area and the end address indicated by the isolation unit constitute the current address mask of the first storage area; Based on the address information of the memory pool and the current address mask of the first storage area, the current address mask of the second storage area is determined.

13. The method according to claim 12, characterized in that, The array parameters include the number of unused hard drives and the total number of disks in the hard drive array; Determining the storage capacity of the first storage area based on the array parameters of the hard disk array indicated by the specified change event includes: The product of a specified coefficient and the total capacity of the memory pool is determined as the base storage capacity of the first storage area, wherein the specified coefficient is the product of the ratio of the number of unused hard disks in the hard disk array to the total number of disks and a preset safety factor. The product of the ratio between the basic storage amount of the first storage area and the preset hash calculation granularity, rounded down, and the product of the preset hash value length, is determined as the specified compensation amount. The sum of the specified compensation amount, the basic storage amount of the first storage area, and the preset compensation amount is determined as the intermediate storage amount of the first storage area; Based on a preset alignment granularity, the intermediate storage amount of the first storage area is aligned to obtain the storage amount of the first storage area, wherein the storage amount of the first storage area is an integer multiple of the preset alignment granularity.

14. The method according to any one of claims 1 to 8, characterized in that, The storage controller further includes a power-loss protection circuit, and the method further includes: In response to a power failure event in the memory pool, the first storage area is powered through the power failure protection circuit.

15. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the data recovery method as described in any one of claims 1 to 14.

Images