Admission control method for network card resources

Abstract

The application discloses a kind of admission control methods of network card resources, comprising: receiving the creation request of target object containing architecture information, suspending actual back-end creation action for the target object, pending admission transaction is established;Resource footprint conversion is carried out based on the architecture information, and the multi-dimensional equivalent footprint that characterizes on-chip metadata resource pressure is obtained;Based on the pre-constructed orthogonal probe library and multi-dimensional equivalent footprint, determine the probe activation sequence corresponding to the footprint shape, and perform counterfactual stress rehearsal using the sequence, to obtain the rehearsal decision result;Based on the decision result and pending admission transaction, generate the final admission decision, and perform admission or rejection operation on the target object before returning the object handle.The present application can judge the risk of hardware performance degradation before object establishment, which is beneficial to avoid the nonlinear congestion of cache resources and to realize the stability of the system in concurrent environment.

Description

Technical Field

[0001] This invention relates to virtualized network device management technology, and in particular to an admission control method for network interface card resources, such as an admission method for remote direct memory access (RDMA) memory region and queue pairs based on resource equivalence probes when a single virtual function level (per-VF) on-chip resource counter is missing. Background Technology

[0002] In multi-tenant virtualized computing architectures, the on-chip cache resources of physical network interface cards (NICs) need to be shared by multiple virtual systems. Properly scheduling and isolating concurrent hardware-level resource request operations is crucial for maintaining the stability of the underlying communication infrastructure and the predictability of data flow under high-concurrency throughput conditions.

[0003] Existing network resource allocation strategies typically rely on static quota hard blocking or global rate limiting intervention after device malfunctions. When handling concurrent network metadata object registration requests, conventional mechanisms often only record the surface capacity allocated to the object in the control plane, or passively trigger bandwidth shaping after significant latency jitter occurs in the service plane. This processing logic based on static quantity constraints or post-incident troubleshooting cannot accurately capture the nonlinear state changes caused by cross collisions in the underlying complex shared cache. This often leads to performance degradation in the overall throughput and tail latency of the physical device before the surface quota is exhausted.

[0004] In summary, existing equipment struggles to effectively predict and avoid nonlinear performance drops in the underlying hardware when faced with high-concurrency and heterogeneous communication resource requests. Therefore, it is necessary to research a control mechanism that can improve the stress resistance and scheduling robustness of the underlying communication infrastructure while achieving service performance isolation. Summary of the Invention

[0005] The purpose of this invention is to provide an access control method for network interface card (NIC) resources, in order to solve the above-mentioned problems existing in the prior art.

[0006] To address the aforementioned problems in the existing technology, the present invention provides the following technical solution, comprising: receiving a creation request for a target object containing architectural information, suspending the actual backend creation action for the target object, and establishing a pending admission transaction; Based on the architecture information, a resource footprint transformation is performed to obtain a multi-dimensional equivalent footprint representing the on-chip metadata resource pressure. Based on the pre-constructed orthogonal probe library and the multidimensional equivalent footprint, the probe activation sequence corresponding to the shape of the multidimensional equivalent footprint is determined, and the counterfactual pressure pre-simulation is performed using the probe activation sequence to obtain the pre-simulation judgment result. Based on the pre-judgment results and the pending admission transactions, a final admission decision is generated, and before returning the object handle to the requester, the corresponding admission or rejection operation is performed on the target object based on the final admission decision.

[0007] This includes, before suspending the actual backend creation action for the target object: Extract current driver capability information and virtualization configuration status; When the drive capability information or the virtualization configuration state does not meet the trusted control context requirements, the static quota benchmark is used to perform the corresponding admission or rejection operation on the creation request.

[0008] The beneficial effects of this invention are as follows: By halting backend actions and applying counterfactual stress tests to the hardware equivalent to the requests, congestion management is moved forward as an effective defense before allocation, which helps to suppress global tail latency degradation caused by the forced preemption of invalid resources.

[0009] By adopting a transformation mechanism that maps abstract communication requirements to a three-dimensional equivalent footprint of translation, protection, and context, the differences in the underlying architecture are reduced, and a unified quantitative assessment benchmark is provided for the risk of resource crowding under concurrent conditions.

[0010] Utilizing a pre-reserved orthogonal probe library to perform pure data surface injection assessment helps to suppress the interference of control commands on the environmental baseline and improves the purity and attribution accuracy of stress response results.

[0011] Furthermore, when faced with scenarios involving exceeding limits and blocking, locking the dominant resource axis and performing object reorganization oriented towards the physical topology achieves a shift from rejection to adaptive degraded scheduling without disrupting upper-layer semantic interactions, thus improving the overall success rate of access to business resources. Coupled with runtime device fingerprinting and a closed-loop reconciliation mechanism, it helps to promptly correct static ledger drift caused by long-term operation, enhancing the consistency maintenance capability between the scheduling center and the underlying physical evolution state. Attached Figure Description

[0012] Figure 1 This is a flowchart of the network card resource access control method of the present invention.

[0013] Figure 2 This is a flowchart illustrating the multidimensional equivalent footprint representing on-chip metadata resource pressure obtained by the present invention.

[0014] Figure 3 This is a flowchart of the relevant steps in this invention before performing counterfactual pressure simulation using the probe activation sequence.

[0015] Figure 4This is a flowchart of the present invention, which uses the probe activation sequence to perform counterfactual pressure pre-simulation and obtain the pre-simulation judgment result.

[0016] Figure 5 This invention allows for the rewriting of decision-making processes. Detailed Implementation

[0017] Example 1: like Figure 1 As shown, this embodiment provides an access control method for network interface card (NIC) resources, which is applied to the system operating architecture in a multi-tenant virtualization environment.

[0018] Specifically, the system architecture includes physical network interface cards (NICs) and multiple virtual NICs. When multiple virtual functions run on the same physical NIC, on-chip metadata resources such as memory translation descriptors, memory protection descriptors, and queue pair contexts are typically shared by multiple entities.

[0019] Specifically, the method includes the following steps: Step 101: Receive the creation request of the target object containing architecture information, suspend the actual backend creation action for the target object, and establish a pending admission transaction.

[0020] In scenarios with concurrent resource requests from multiple tenants, directly issuing creation commands can easily lead to loss of control over the underlying hardware resource state. To avoid irreversible impacts on cache state caused by the creation of real network interface card (NIC) objects, the scheduling system actively intercepts creation requests issued by upper-layer applications at the trusted control entry point. At this time, the control flow does not actually invoke backend physical hardware operations, nor does it expose any object handles to the requester. By extracting the virtual function identifier, object type, and related configuration parameters involved in the request, a set of independent data structures specifically used to record the intent of the request is constructed on the memory side. The above processing transforms concurrently arriving, out-of-order creation actions into serially queued pending admission transactions, providing a static snapshot for subsequent capacity extrapolation and pre-occupancy risk assessment.

[0021] Step 102: Based on the architecture information, perform resource footprint transformation to obtain a multi-dimensional equivalent footprint representing the on-chip metadata resource pressure.

[0022] Directly utilizing the memory space size or concurrent connection count requested by the application layer often fails to accurately reflect the cache contention situation of the underlying hardware under full load. To accurately measure the potential hardware resource consumption of creation actions, the architectural information extracted in the preceding steps is mapped into a multi-dimensional equivalent footprint. This multi-dimensional equivalent footprint is specifically represented internally as a structured three-dimensional vector data, where each dimension corresponds to the translation descriptor, protection descriptor, and the maximum number of entries that the queue context may occupy in the on-chip cache. This vectorized mapping processing logic isolates the underlying hardware implementation differences between different device manufacturers, unifying heterogeneous resource request requests into equivalent resource pressure characteristics that can be mathematically quantified and compared.

[0023] Step 103: Based on the pre-constructed orthogonal probe library and the multidimensional equivalent footprint, determine the probe activation sequence corresponding to the shape of the multidimensional equivalent footprint, and use the probe activation sequence to perform counterfactual stress pre-play to obtain the pre-play judgment result.

[0024] Conventional static quota management methods are insufficient to address the nonlinear performance degradation that occurs instantly when on-chip cache boundaries are breached.

[0025] To detect potential performance precipitates in advance, the device pre-hosts a set of orthogonal probes during the initialization phase. This orthogonal probe set refers to a collection of probe objects independently categorized by on-chip resource axis type. When pressure is applied, probes along each resource axis only change the on-chip cache usage of that single dimension. Probes along different axes do not interfere with each other, thus enabling independent or joint controlled injection of resource pressure across various dimensions. During normal online service phases, these probe objects only send probe data and do not perform registration or deregistration actions involving metadata allocation.

[0026] The system extracts the limit values ​​of each dimension of the aforementioned multidimensional equivalent footprint, accurately selects the idle probe working set that matches the pressure values ​​of each dimension from the orthogonal probe library, and combines them to generate a probe activation sequence of a specific shape.

[0027] The sequence is injected into the network interface card (NIC) data forwarding plane according to the preset control logic. By applying physical access pressure of the same scale to the hardware before the real tenant object is landed, and collecting the actual tail latency and throughput flow status of the NIC under full load pressure, a pre-simulation judgment result is finally generated to qualitatively characterize the current hardware carrying capacity.

[0028] Step 104: Generate a final admission decision based on the pre-judgment result and the pending admission transaction, and before returning the object handle to the requester, perform the corresponding admission operation or rejection operation on the target object based on the final admission decision.

[0029] The system reads the actual hardware response data after the counter-incident pressure is applied, and combines this data with the original requests recorded in the pending admission transactions to generate a final admission decision for closed-loop control. This final admission decision is represented as a control instruction code in the code logic.

[0030] When the determination result indicates that the network card hardware cache can withstand the expansion of the working set to this scale without malicious contention, the system issues the actual entity registration action to the underlying driver according to the allow command code, and only returns the object handle to the top-level caller after confirming that the backend hardware has been successfully created; otherwise, if the determination result indicates that there is a risk of hardware performance exceeding the limit, a silent revocation or rollback operation is performed.

[0031] The entire admission and interception process helps maintain strong consistency between the visible state of external tenants and the underlying physical state, and helps to suppress global hardware-level performance risks caused by excessive usage by individual tenants.

[0032] Example 2: Further explanation of the pre-verification process before executing the suspension action. As a system-level alternative control strategy, one possible implementation includes the following steps: Step 201: Extract the current driver capability information and virtualization configuration status.

[0033] Upon receiving a resource creation request, the scheduling module reads the device capability list and the fingerprint of the currently running device. The extracted driver capability information specifically includes whether the current driver supports metadata operation interception and whether it has the ability to insert pre-rehearsal hooks in the control plane.

[0034] The extracted virtualization configuration status is used to determine whether the current network interface card (NIC) is in full hardware passthrough mode or mediated passthrough mode controlled by the super manager. By obtaining these low-level configuration identifiers, a device context baseline is established for subsequent judgments.

[0035] Step 202: When the drive capability information or the virtualization configuration state does not meet the trusted control context requirements, the static quota benchmark is used to perform the corresponding admission or rejection operation on the creation request.

[0036] Based on the extracted device characteristics, determine whether the current system has a control entry point for implementing counterfactual simulations. If, in pure hardware pass-through mode, the management agent cannot intercept memory region registration requests initiated by the virtual function side, or if the management probe path and the tenant data path do not share the same physical network card, then the trusted control context requirement is not met.

[0037] In this scenario, the elastic stress simulation process is stopped, and instead, the backup degradation decision logic is invoked. The static quota baseline hard-allocated by the vendor during initialization is read, and the difference between the total number of ledger entries currently occupied by virtual functions and this hard quota is compared. If the remaining quota is greater than the requested amount, an admission operation is performed; otherwise, a resource exhaustion rejection operation is returned. This alternative approach improves the robustness of resource management in heterogeneous or constrained hardware environments.

[0038] Example 3: As Figure 2 , Figure 3 As shown, the specific implementation mechanism of the pre-constructed orthogonal probe library in Example 1 will be further explained. The construction of the probe library is a prerequisite for ensuring that the stress simulation results can be attributed.

[0039] In one possible implementation, the following steps are included: Step 301: Create a probe object during the system initialization phase.

[0040] Before tenant services are officially integrated, the system allocates corresponding space in host memory and interface configuration memory based on the capacity estimates of each resource axis obtained from table lookup. Specifically, it creates translation page working set probes, protection descriptor probes, and queue pair context probes.

[0041] The number of pre-created probe objects is set to be no less than 1.5 times the upper bound of the estimated capacity of the corresponding resource. After the objects are created, tail delay samples are continuously collected to monitor the transient state caused by initialization. When the tail delay variation coefficient within the continuous sampling window is lower than the preset 5% decay threshold, a stable baseline state is recorded.

[0042] Specifically, tail delay baselines under stress-free conditions are collected on both the physical and virtual functional sides to obtain the physical side baseline and the virtual side baseline. Step 302: Apply probe access pressure to the physical function side and collect the pressure tail delay sample of the corresponding virtual function side relative to the virtual side baseline to obtain the relative increase.

[0043] The premise for probe stress simulation to be valid is that different functional sides share the same on-chip cache.

[0044] During initialization, the control module selects a memory region for verification on the physical functional side, performs a remote read operation on it, and records the physical side baseline under interference-free conditions. While keeping the access mode of the virtual functional side control group unchanged, the number of active access pages on the physical side is increased to a level close to the upper limit of the estimated capacity.

[0045] By using the network layer feedback mechanism, independent tail delay samples of the corresponding virtual function side when subjected to side channel compression are extracted, providing input data for subsequent correlation calculation.

[0046] Step 303: Based on the relative increase of the stressed tail delay sample relative to the tail delay baseline, determine whether the physical function side and the virtual function side share the target cache level, and obtain the probe coupling verification result.

[0047] After obtaining the delay samples collected in the previous steps, the ratio of the tail delay under pressure to the tail delay under the interference-free baseline state is calculated.

[0048] Among them, the relative increase in tail delay R increase =(L1-L0) / L0; L1 is the tail delay sample of the virtual function side under pressure, and L0 is the baseline tail delay of the virtual function side under interference-free conditions.

[0049] Based on the above calculation results, there exists a micro-level conditional judgment branch.

[0050] In the first case, when the calculated relative increase exceeds the preset coupling confirmation threshold of 5% to 15%, and the virtual tail delay falls back to the confidence range after the physical side pressure is removed, it is determined that the physical and virtual functions in this direction share the target cache level, and the verified probe coupling verification result is output.

[0051] In the second scenario, when the relative increase does not reach the threshold, it is determined that the network interface card (NIC) has achieved hardware partitioning isolation, and the probe pressure on the physical side will not be transmitted to the virtual function side. In this case, sharing is deemed invalid, and the probe coupling verification result that failed is output. Subsequent downgrades for this dimension will use static quotas.

[0052] Step 304: Based on the successful probe coupling verification results, confirm the completion of the construction of the orthogonal probe library; when the probe coupling verification results fail, the resource dimensions that fail the verification are downgraded to static quotas.

[0053] Upon receiving the verified probe coupling results, the corresponding probe set status bit is marked as ready, and it is added to the orthogonal probe library available for online use. This verification action helps to suppress pre-playback distortion caused by hardware isolation, enabling the verified probe library to have the physical basis for implementing cross-dimensional compression tests.

[0054] Step 305: During the online business phase, the probe object is constrained to only change the active probe set by sending data or reading operations, so as to avoid triggering the registration or deregistration actions of the probe object, thereby obtaining the pre-built orthogonal probe library.

[0055] Once the system enters its online lifecycle to process real tenant requests, constraints are imposed on the behavior boundaries of the probe object to prevent the probe's own control plane operations from polluting the cache state being tested.

[0056] When it is necessary to increase probe pressure, only injecting data into the existing probe set to send or read commands is allowed to expand or shrink the size of the rotating active working set.

[0057] Within the pre-evaluation window, system calls to create new memory regions, bind memory windows, or destroy queue pairs for these probes are blocked. By cutting off the path for measurement tools to corrupt the metadata state of the system under test, the pre-built orthogonal probe library is obtained, which helps improve the attribution accuracy between the subsequently collected performance response and the pre-evaluation stress.

[0058] Example 4: The specific implementation mechanism of the aforementioned resource footprint transformation is further explained, and a risk pre-screening mechanism based on static ledger is introduced.

[0059] like Figure 4 As shown, in one possible implementation, the following steps are included: Step 401: Determine the memory access range of the target object based on the architecture information, and calculate the equivalent increment of the translation descriptor.

[0060] Upon receiving the configuration parameters for the memory region, the processing unit extracts its initial input / output virtual address and registration length. By combining the virtual address and length and performing calculations based on the actual device page granularity alignment rules of the underlying system, the total number of physical page mappings required by the object on the device side is calculated, thereby obtaining the equivalent increment of the translated descriptor. This operation converts the upper-layer contiguous address space into discrete physical page table entry overhead, providing input for subsequent evaluation of address translation cache occupancy.

[0061] Step 402: Based on the minimum page granularity or mixed page granularity of the target object actually used for device translation, a conservative upper bound for translation access is calculated to be used to calculate the equivalent increment of the translation descriptor.

[0062] In some heterogeneous environments, it may be impossible to obtain the actual page granularity from the programming network interface card (NIC) at the initial stage of object creation. In this case, a degradation compensation strategy is implemented. The finest-grained page size supported by the device's own hardware architecture is extracted as the underlying benchmark and substituted into the aforementioned physical page boundary alignment calculation logic to obtain a conservative upper bound for translated access. This value represents the maximum number of cache entries that may be generated, preventing the equivalent incremental evaluation from failing when the underlying device uses fine-grained mapping.

[0063] Step 403: Determine the permission configuration form of the target object based on the architecture information, and calculate the equivalent increment of the protection descriptor.

[0064] The system parses the incoming architecture information and extracts the permission exposure method of the object to be created. Based on preset mapping and transformation rules, it assigns corresponding footprint weights to objects of different forms. During execution, if the object is a regular fixed memory region or an on-demand paging region, it is mapped to one protection descriptor overhead. If memory windows are involved, they are mapped to the sum of one overhead of the base region itself and the number of bound windows. For indirect memory key objects, the system extracts their configured hierarchy depth and directly maps this depth value to descriptor overhead.

[0065] Step 404: Determine the transmission connection type of the target object based on the architecture information, and calculate the context equivalent increment of the queue.

[0066] This section extracts the connection attributes negotiated between the two communicating ends and identifies their relevant contextual features. Different transmission mechanisms maintain state machines with varying complexity within the network interface card (NIC) chip; based on this, initial queue pairs are allocated according to context occupancy. This step transforms the abstract network connection protocol into quantified on-chip static random access memory (SRAM) consumption units.

[0067] Step 405: When the transmission connection type includes a shared receive queue, allocate a reduced context occupancy factor to calculate the context occupancy increment of the queue; When a connection type is found to have a shared receive queue attribute, degradation reduction logic is applied. Since multiple transmit queues share the same receive buffer pool, their independent context states are merged. The system assigns a reduction factor to this queue pair in the range of 0.5 to 1.0. In some optional implementations, this factor can be obtained through differential experimental calibration, i.e., extracting the proportion of probe response difference between independent and shared receive states while keeping the total number of queue pairs constant. Alternatively, the corresponding factor can be directly obtained by consulting the interface specification datasheet provided by the device manufacturer.

[0068] Step 406: Obtain the pre-stored lower bound of the capacity of each resource axis and the currently maintained shadow footprint ledger.

[0069] The system invokes the shared state region maintained by the system kernel to read the effective security boundaries of various types of metadata calibrated during the previous calibration phase, i.e., the lower bounds of the capacity of each resource axis. It synchronously pulls the shadow footprint ledger file used to map the current physical state of the network interface card in order to grasp the real-time resource distribution.

[0070] Step 407: Extract the existing resource occupancy status based on the shadow footprint ledger.

[0071] The retrieved shadow footprint ledger is parsed, and the overhead of currently registered and active objects for each virtual function, as well as the pre-allocated quota of pending transactions waiting to be created, are added together. This data is then merged to output the existing resource occupancy status for each resource dimension.

[0072] Step 408: Based on the existing resource occupancy status, the multidimensional equivalent footprint, the pre-configured protection margin, and the lower bound of the capacity of each resource axis, calculate the occupancy risk value of the corresponding resource axis.

[0073] By combining the aforementioned extracted static historical occupancy, the equivalent footprint increment brought by the current request, and the margin for dealing with sudden traffic, a dimensionless mathematical evaluation of the stress resistance of each resource axis is performed.

[0074] For the specific calculation formula, please refer to step S24 of the following embodiment 9.

[0075] Step 409: Perform security pre-screening based on the occupancy risk value, and allow the execution of the step of performing counterfactual pressure pre-simulation using the probe activation sequence when the occupancy risk value meets the preset security conditions; when the occupancy risk value does not meet the preset security conditions, directly generate the final admission decision indicating rejection or rewriting based on the pending admission transaction.

[0076] The independently calculated risk values ​​are evaluated in parallel. Conditional business routing logic is implemented here. In the first business path, if the risk values ​​for translation, protection, and queuing are all less than 1.0, the static model gate pre-screening is passed, and a token is issued to allow the request to enter the subsequent probe pre-run queue. In the second business path, if any risk value is greater than or equal to 1.0, the current request is deemed to have a static risk of breaching the lower bound of the cache. The model gate rejects its direct passage, intercepts instructions to apply large-scale probe pressure, and instead triggers corresponding degradation interception or rewriting actions.

[0077] Example 5: When the occupancy risk value meets the preset safety conditions, this example further elaborates on the aforementioned dynamic testing scheme for counterfactual stress simulation. In one possible implementation, the following steps are included: Step 501: Obtain multiple pre-configured pseudo-random permutation seeds.

[0078] To prevent probe data from accidentally falling into a cache group with an extremely low conflict rate when mapped to on-chip hardware, which could lead to measurement failure, the system extracts at least three independent pseudo-random numbers from the entropy pool of the operating environment as pseudo-random permutation seeds, and uses these as starting factors for generating spatial perturbation sequences.

[0079] Step 502: Based on the multiple pseudo-random permutation seeds and the multidimensional equivalent footprint, a mapping combination is performed to generate a probe activation sequence with spatial distribution differences.

[0080] The physical addressing of the test space is rearranged using extracted pseudo-random numbers. A cross-sampling operation is performed on the pre-created probe object pool based on the upper bound defined in the multidimensional equivalent footprint. The resulting multiple probe activation sequences can forcibly disrupt memory access patterns, forcing the stress test to cover a wider range of cache collisions.

[0081] Step 503: Apply the baseline period, stress period and recovery period respectively according to the staggered timing sequence.

[0082] Configure a time-slicing scheduling mechanism to divide a single pre-run process into multiple rounds of millisecond-level cyclic operations. In each round, a continuous three-segment operation interval is forcibly inserted, including a baseline period, a stress period, and a recovery period. By frequently switching load states, the indicator mutations induced solely by stress injection are separated, thereby eliminating confounding factors such as long-tail network congestion.

[0083] Step 504: Maintain a preset size of active probe set during the baseline period and the recovery period, and collect performance samples during the baseline period and the recovery period, respectively.

[0084] Within the baseline and recovery time slices without additional load, maintain a very small set of probe activities, which only utilizes resources of no more than 100 pages, 10 memory regions, and 10 queue pairs. Collect probe throughput and data completion rate metrics during this period to form a reference baseline after no load or load reduction.

[0085] Step 505: Apply equivalent pressure according to the probe activation sequence with spatial distribution differences during the pressure period, and collect the performance sample of the pressure period; generate the pre-judgment result based on the performance sample of the baseline period, the performance sample of the pressure period, and the performance sample of the recovery period.

[0086] The system sends a large-scale probe activation command generated in the preceding steps to the network interface card (NIC) data forwarding plane. Without performing any creation or deregistration actions, the selected probes send high-speed probe streams. The system captures dynamic stress feedback when approaching its maximum buffer capacity, and extracts the high-quantum-tail latency performance during this period as a stress sample.

[0087] Step 506: During the application of pressure, monitor the response slope and tail delay of the corresponding active probe set in real time (continuously).

[0088] A smooth sliding window is constructed to track the two core metrics mentioned above. The calculation module calculates the difference between the tail delay of the current sampling period and the tail delay of the previous period, and divides this difference by the number of probe working set units added between the two periods to obtain the discrete response slope. The measured tail delay values ​​within this window time are collected synchronously.

[0089] Step 507: When the response slope or the tail delay triggers the warning threshold condition, immediately stop increasing the equivalent pressure of the probe activation sequence, and directly mark the currently collected samples as early stop samples that represent insecurity; and generate the pre-simulation judgment result representing insecurity based on the early stop samples.

[0090] This section introduces dynamic overload prevention branch blocking logic. In the first operating condition, when both the measured response slope and tail delay remain within the tolerance range set by the historical smooth curve, the scheduler continues to increase the probe load according to the original plan. In the second operating condition, when the discrete response slope jumps by more than three times the historical median, or the measured tail delay expands to 1.3 to 1.8 times the baseline, an avalanche warning is triggered. The control program unconditionally interrupts the probe activation sequence, intercepts subsequent boost commands, and forcibly labels the captured truncated data with an early stop tag indicating unsafety.

[0091] Step 508: Calculate the relative time delay perturbation based on the baseline period performance sample and the stress period performance sample; Iterate through all successfully completed interleaved sampling rounds and calculate the percentage degradation of the stressed latency compared to the baseline latency in each round.

[0092] Wherein, the time delay relative to the perturbation ρ in the current round, ρ=max(0,(L press -L base ) / L base) ; L press For the 99th percentile tail delay sample during the stress period, L base This represents the 99th percentile tail delay sample of the baseline period. The external maximization operation filters out random negative delay reduction values, ensuring that the perturbation amplitude output has a non-negative characteristic.

[0093] Step 509: Using a block resampling method that maintains time-dependent characteristics, the upper confidence boundary is calculated based on the relative time delay disturbance.

[0094] Because network latency has an inherent temporal correlation, direct extraction leads to a narrowing of the confidence interval. The system reads the decay period of the sequence autocorrelation function or directly takes the square root of the total number of samples, using this as the length of the extracted data block. Multiple random replacement extractions are performed on the sample set using this length as the unit, fitting a one-sided upper confidence bound that meets this characteristic. As an alternative, if tenants set strict timeout limits resulting in fewer than 5 interleaving rounds, the system abandons block extraction and instead applies the Student's t-distribution algorithm to theoretically compensate for small sample biases to obtain the upper confidence bound.

[0095] Step 510: When the upper confidence boundary meets the preset perturbation threshold and the performance sample of the recovery period returns to the confidence interval of the performance sample of the baseline period, a pre-simulation determination result representing safety is generated; when the upper confidence boundary does not meet the preset perturbation threshold or the performance sample of the recovery period does not return to the confidence interval of the performance sample of the baseline period, a pre-simulation determination result representing insecurity is generated.

[0096] Read the upper confidence bound of the aforementioned calculation output and compare it with a safety jitter threshold of 5% to 15%. Simultaneously, verify whether the indicators during the recovery period smoothly fall back to the baseline range. Output a pre-simulation judgment result indicating safety only if the confidence bound is below the threshold and all indicators of the device exhibit reversibility after the pressure is removed. If indicators are found to remain high for an extended period during the recovery period or if there is excessive promiscuous drift in the baseline, block the occurrence of the safety state and intercept the backend landing of this request.

[0097] Example 6: Unlike Example 5 above, which directly rejects requests based on the pre-rehearsal results, this example provides an alternative solution aimed at improving the success rate of admission.

[0098] like Figure 5 As shown, in one possible implementation, the following steps are included: Step 601: Determine the dominant resource axis based on the ratio of each component in the multidimensional equivalent footprint to the capacity of the corresponding resource axis.

[0099] Whether it's due to the failure of the initial model gate pre-screening or the insecurity judgment of the subsequent counterfactual stress simulation output, as long as the context environment attached to the current tenant's request allows modification of the underlying configuration, the resource management module will trigger the rewrite strategy.

[0100] By iterating through the values ​​of each component in the multidimensional equivalent footprint, dividing each component by its corresponding total capacity, and extracting the specific dimension with the largest ratio, this dimension is marked as the dominant resource axis. This action isolates non-primary contradictions and concentrates optimization computing power on the resource consumption direction with the highest risk.

[0101] Step 602: Generate a rewrite object request based on the resource constraints corresponding to the dominant resource axis, while maintaining the original communication semantics of the target object.

[0102] Once the dominant resource axis is located, the corresponding candidate registration pattern generation mechanism is invoked. Parallel rewrite branch logic is set up at this stage to adaptively handle different types of resource limit exceedance situations.

[0103] In the first rewrite branch, when the dominant resource axis is the translation descriptor axis, the system calls the big page replacement logic or the pre-registered buffer pool mechanism, provided that the buffer has not yet been exposed to the far end and the address alignment condition is met. In offline computing tasks that allow for some page fault latency, ordinary regions are forcibly converted into on-demand paging regions to reduce the overhead of continuous page table mapping.

[0104] In the second rewrite branch, when the dominant resource axis is the protection descriptor axis, a permission merging operation is performed. The control program scans and merges adjacent small memory regions with the same permission attributes, and invokes the protected memory window mechanism to expose sub-regions externally, thereby reducing the total number of discrete keys.

[0105] In the third rewrite branch, when the dominant resource axis is the queue pair context axis, if the upper-layer communication semantics such as reliability and congestion control are not affected, the logical queue pair reuse or active lease mechanism is forcibly enabled.

[0106] After adjusting the form of any of the above branches, the rewritten object request with updated parameters is output, ensuring that the physical consumption is reduced while the communication function is complete.

[0107] Step 603: Re-trigger the step of resource footprint transformation based on the architecture information based on the rewritten object request; if it is still determined to be insecure after re-replay based on the rewritten object request, perform a rejection operation on the target object.

[0108] After obtaining the generated rewrite object request, the scheduling system sends its internal parameters back to the footprint parsing entry point. It reads the updated configuration information and restarts the translation, protection, and context equivalence increment calculation process, forming a control loop that includes re-verification and rehearsal. Executing the rewrite action itself does not exempt one from risk verification; all generated candidate solutions must be verified for their robustness and security under the current physical hardware environment to avoid introducing new resource limit violations.

[0109] Example 7: After completing the admission operation and returning the object handle in the above examples, this example provides a runtime continuous monitoring and ledger closed-loop update mechanism. In one possible implementation, it includes the following steps: Step 701: Collect operational observation responses and current device fingerprints in real time or periodically; During the instantiation of the target object and its commencement of business traffic, the system kernel initiates a background sentinel process. This process periodically captures throughput, actual tail latency, and cache hit rate data from the network interface card registers and driver state machine, forming a runtime observation response sequence. Simultaneously, it reads underlying hardware identifiers such as firmware version and link status, and updates them to the current device fingerprint. This continuous data collection provides real-world comparative samples for verifying the reliability of previously pre-simulated assessments.

[0110] Step 702: Based on the operational observation response and the current device fingerprint, identify the device state drift situation; The measured execution sequence obtained in the preceding steps is extracted and numerically verified against the baseline confidence range recorded in the calibration epoch. If the comparison reveals a version-level change in the current device fingerprint, or if the fixed sentinel response continuously deviates from the confidence interval beyond the set allowable variance, the computation unit determines that the original calibration relationship is invalid and outputs a device state drift characteristic of hardware environment degradation. This identification process captures irreversible shifts in underlying carrying capacity caused by firmware hot-swapping or changes in the physical environment.

[0111] Step 703: Maintain object lifecycle consistency based on the device state drift situation to obtain the closed-loop updated shadow footprint ledger; Based on the output drift status and object liveness status, the resource record table undergoes mandatory reconciliation and write-off. For connections that normally execute deregistration tasks, the corresponding footprint pre-allocation quota is deducted from the total ledger amount; for abnormally suspended orphan objects, a mandatory reclamation and cleanup command is executed. When the system detects device state drift, new elastic admission channels are frozen, and rate-limiting constraints are imposed on existing active objects. Through the above dynamic feedback and state alignment, a closed-loop updated shadow footprint ledger that reflects the current true load distribution of the physical hardware is output.

[0112] Example 8: In another specific embodiment, an adaptive degradation processing method is provided for special heterogeneous hardware architectures where network interface cards do not support independent probe scanning.

[0113] The system retrieves the performance counters of the underlying hardware to determine if the device probe mechanism supports independently applying pressure across all resource dimensions. When the device architecture is determined not to support separate scanning operations on the protection descriptor axis or queue pair context axis, a forced merging logic is triggered. For example, if the network interface card (NIC) cannot independently change the number of memory keys without altering the translation page count, the computation module merges this non-independently identifiable resource dimension with its associated identifiable resource dimension to construct a composite merged resource axis. Subsequently, the system reads the physical hardware's maximum carrying capacity under this composite state and outputs a single capacity lower bound.

[0114] Based on this, the operational rules for the static model gate risk pre-screening are synchronously revised. When performing risk value calculation, the numerator parameter in the calculation formula is updated to the mathematical sum of the upper bounds of the original components under the merged resource axis, and the preset protection margin value is increased proportionally. Correspondingly, when the decision flow enters the dominant resource axis rewriting stage, the control logic intercepts and eliminates rewriting candidate actions for dimensions that cannot be independently calibrated, allowing object attribute optimization only to be performed on resource dimensions with independent observation capabilities. This alternative solution enables the admission control mechanism to operate continuously in constrained underlying hardware.

[0115] Example 9: The following is a more detailed and complete example to comprehensively explain the collaborative working process and specific parameter configuration of each step in the above examples.

[0116] The steps involved in this embodiment are consistent with the technical content of the previous embodiments. The added details are used to further clarify the specific implementation method: S1. Create a device calibration environment that can be used for request-level pre-simulation.

[0117] Read the predefined device capability list, probe object template and historical calibration record, confirm the trusted control entry, create online probe objects without registration and deregistration, and mark the effective security boundaries of each on-chip resource direction to obtain the calibration epoch, pre-created orthogonal probe library, resource axis capacity lower bound and initial shadow footprint ledger.

[0118] S11. Read the device capability list, driver capability information, virtualization mode and current device fingerprint. Check whether memory region registration, memory key creation, memory window binding and queue pair creation pass through an unbypassable control entry point. Also check whether the management probe and tenant data path use the same physical network card and target cache level to obtain the trusted control context and probe coupling verification results.

[0119] Device fingerprints must include at least the network interface card (NIC) model, firmware version, driver version, link mode, and virtualization configuration. If probe coupling verification fails, elastic pre-rehearsal admission will not be enabled; instead, it will revert to vendor static quotas or be denied sharing.

[0120] In some embodiments, probe coupling verification is performed as follows: During the initialization phase, before the tenant has connected, a verification memory region is selected on the physical function side, a remote read operation is performed on it, and the tail delay baseline is recorded. Simultaneously, a reference memory region is registered on the target virtual function side to record its tail latency baseline during independent operation. Subsequently, on the physical function side, the number of actively accessed pages in the verification memory region was increased to a level close to the upper bound of the estimated translation descriptor capacity, while the access pattern of the reference memory region on the virtual function side remained unchanged, and the tail latency on the virtual function side was collected. If the relative increase in virtual function tail latency satisfies: ; Furthermore, if the tail delay on the virtual function side falls back to the baseline confidence range after the baseline access range is restored on the physical function side, then probe coupling in that direction is considered valid. Coupling confirmation threshold. A value of 5% to 15% is recommended, and the specific value can be adjusted according to the baseline noise level of the equipment.

[0121] The aforementioned cross-influence verification is performed on the translation descriptor, protection descriptor, and queue context in three directions. If the coupling verification fails in any direction, elastic pre-rehearsal admission is not enabled for that direction; only vendor static quotas are used, or sharing is denied.

[0122] When the network interface card (NIC) implements hardware partitioning isolation for on-chip caching, the probe pressure on the physical function side will not be transmitted to the virtual function side. Coupled verification failure is expected, and this solution is not applicable in this scenario. This verification is performed during system initialization or maintenance windows, not during tenant service operation.

[0123] S12. Read the trusted control context, probe coupling verification results, and probe object template. During the system initialization phase, create translation page working set probes, protection descriptor probes, and queue pair context probes. After initialization, wait for the transient state caused by the registration behavior to subside and record the stable background footprint to obtain the pre-created orthogonal probe library and probe stable baseline.

[0124] The translation page working set probe uses a fixed memory region and a fixed queue pair, only varying the number of different pages accessed.

[0125] The protection descriptor probe changes the number of memory regions or memory keys while keeping the total number of pages accessed constant, and differentiates the response from accessing the same number of pages from a single memory region.

[0126] The queue pair context probe maintains a relatively constant total bandwidth, packet rate, message size, operation direction, and number of requests in transit, only changing the number of queue pairs that are rotated and activated.

[0127] During the online rehearsal phase, you must not create or deregister probe memory regions, memory keys, or queue pairs for any request.

[0128] The pre-created number of probe objects for each axis should ensure that the maximum equivalent working set that the probe can activate is not less than 1.5 times the upper bound of the estimated capacity of that axis. The host memory overhead and interface configuration memory overhead of the probe objects are negligible relative to typical server configurations and will not affect normal system operation. In some embodiments, the process of determining the number of probe objects for each axis is as follows: The pre-created number of probe objects for each axis should meet the following requirement: the maximum equivalent working set that a probe can activate should be no less than 1.5 times the upper limit of the estimated capacity for that axis, to cover the entire stress range of calibration scans and request-level pre-runs. Translation page working set probes use a pre-registered large memory region covering different page numbers. Should meet: ; In the formula, This is an initial estimate of the translation descriptor capacity obtained from a table lookup or initial calibration based on the device model. For current mainstream network interface cards (NICs), the on-chip static random access memory (SRAM) capacity ranges from 2 to 8 megabytes. Each translation descriptor entry occupies 8 to 16 bytes, corresponding to 130,000 to 1,000,000 entries. However, the actual effective capacity is far lower than this value due to the sharing of various metadata. It is recommended to pre-create a memory region covering no fewer than 100,000 different pages, corresponding to approximately 400 megabytes of host memory at a 4,000-byte page granularity.

[0129] The protection descriptor probe pre-creates multiple small memory regions of equal length, each covering only one page. The number of pre-created regions is... No fewer than 4096 recommendations.

[0130] The queue pair context probe pre-creates a set of queue pairs, each using the minimum queue depth, i.e., a recommended sixteen work request entries. No fewer than 2048 recommendations.

[0131] The host memory overhead and interface configuration memory overhead of the probe objects are negligible compared to the scale of a typical server, and will not affect the normal operation of the system. The specific number of probe objects can be configured by those skilled in the art based on the estimated capacity of the equipment resources.

[0132] The interface configuration memory overhead for probe objects is approximately 800 kilobytes to 1.6 megabytes for translation descriptor entries, approximately 256 kilobytes for protection descriptor entries, and approximately 512 kilobytes for queued context entries, totaling no more than 3 megabytes, which accounts for 1% to 5% of the typical interface configuration memory allocation.

[0133] During the baseline period, probes use only a fixed, small set of active probes (recommended to be no more than 100 pages, 10 memory regions, and 10 queue pairs), and their on-chip cache usage is negligible. Probe objects that are not actively accessed reside only in the host-side interface configuration memory and do not occupy on-chip cache entries.

[0134] After the probe object is created, tail delay samples are continuously collected from a fixed small set of active samples. When continuous... The coefficient of variation of the tail delay within each sampling period is lower than the decay threshold. At that time, it is determined that the transient state has subsided and a stable background footprint is recorded. Recommendation Take ten to twenty sampling periods. Take 5%.

[0135] S13. Read the pre-created orthogonal probe library, probe stable baseline and current device fingerprint, add probe equivalent working sets for three resource axes respectively, collect robust tail latency, request completion rate and low priority sentinel throughput, and calculate the discrete response slope between adjacent pressure points to obtain resource axis response curves, candidate cliff point set and resource axis capacity lower bound.

[0136] For the k-th resource axis, the discrete slope D k (z) is defined as: D k (z)=[ k (z+δ k )- k (z)] / δ k ; In the formula, z is the probe equivalent working set, δ k Increase the probe size for this resource axis. k (z) represents the robust tail delay under the corresponding pressure, D k The dimension of (z) is time delay divided by the probe equivalent unit.

[0137] When the discrete response slope increases significantly relative to the median historical slope, and the tail delay exceeds the warning ratio relative to the stable baseline for multiple consecutive micro-periods, it is identified as a candidate cliff point. A cliff point refers to a pressure point where the tail delay experiences a nonlinear surge after the on-chip metadata resource occupancy crosses the safety boundary. The one-sided lower confidence boundary of the safety pressure point before the first warning condition is reached is recorded as the lower bound of the resource axis capacity. This one-sided lower confidence boundary is determined by resampling the tail delay samples from multiple sampling periods before and after the pressure point in blocks, and taking the one-sided lower bound at a 95% confidence level.

[0138] The lower bound of the resource axis capacity represents the effective security boundary under the current device, firmware, and background states, and does not represent the number of physical cache entries of the chip.

[0139] The recommended value ranges for each parameter in cliff point detection are as follows.

[0140] Discrete response slope relative to threshold To determine whether the slope has increased significantly relative to the historical median, a value of 3 to 5 is recommended, meaning that an alert should be triggered when the current slope reaches 3 to 5 times the historical median in the sliding window.

[0141] Relative delay threshold To determine whether the tail delay has increased significantly relative to the stable baseline, a value of 1.3 to 1.8 is recommended, meaning the tail delay is 1.3 to 1.8 times the zero-pressure baseline.

[0142] To filter instantaneous spikes, a continuous number of micro-periods (h) is used; 3 to 5 micro-periods are recommended.

[0143] The sliding window width w is used to calculate the median of the historical slope; it is recommended to use 5 to 10 pressure points.

[0144] The recommended sampling duration within each micro-period is 50 to 200 milliseconds, ensuring that a sufficient number of request completion events can be collected within this period to calculate robust tail latency. For a typical remote direct memory access workload with tens of thousands of requests per second, 50 milliseconds can collect thousands of samples, meeting the 99th percentile estimation accuracy requirement.

[0145] probe increase δ k The equivalent working set increment between two adjacent pressure points is recommended to be 2% to 5% of the initial estimate of the corresponding axis capacity, in order to achieve a balance between scanning accuracy and total calibration time.

[0146] S14. Read the current device fingerprint, resource axis response curve, resource axis capacity lower bound and existing object list, and write the virtual function to which the object belongs, object type, actual page granularity, potential translation footprint, protection descriptor footprint, queue-to-context footprint, lifecycle state and calibration version into the ledger to obtain the initial state of the calibration epoch and shadow footprint ledger.

[0147] Each calibration epoch corresponds one-to-one with a device fingerprint. The original calibration epoch becomes invalid if the device fingerprint changes or if the probe response during operation exceeds the calibration confidence range.

[0148] S2. Convert the object to be applied for into the request equivalent footprint.

[0149] Read the memory region or queue pair creation request, calibration epoch and shadow footprint ledger, calculate the potential on-chip metadata footprint of the object to be requested without performing the creation of the real network card object, and convert it into a probe-executable three-dimensional equivalent representation to obtain the pending admission transaction, the request multi-dimensional equivalent footprint and the model gate decision result.

[0150] S21. Read the object creation request, the current calibration epoch, and the shadow footprint ledger. Do not call the real backend control operation or return the object handle to the tenant. Record the virtual function to which the request belongs, the object type, the request parameters, the ledger version, and the calibration version to obtain the pending admission transaction.

[0151] When multiple requests arrive concurrently, pending admission transactions serialize their ledger impact through version comparison and pending quota pre-allocation. Subsequent requests must include both committed objects and pending pre-allocations when calculating existing occupancy to prevent multiple requests from passing separately but then crossing the safety boundary after merging.

[0152] S22. Read the pending admission transactions and host sidepage mapping information, calculate the number of translation descriptors, the number of protection descriptors, and the queue-to-context features according to the object type, and obtain the original architecture footprint.

[0153] For a regular fixed memory region using a uniform actual device page granularity, the upper bound of the number of translation pages covered by the j-th memory region is: n j , max = ((a j mod p j )+ j ) / p j ; In the formula, n j , max a is the upper bound of the number of translation pages covered by the j-th memory region; j This is the starting input / output virtual address. j For the registration length, p j The page granularity used by the backend driver for device translation is byte-based for all three, resulting in dimensionless page numbers; mod represents the modulo operation.

[0154] When mixed page granularity or segmented device mapping exists, the number of translated pages for each mapping segment is calculated separately and then summed. If the actual page granularity cannot be known before programming the network interface card (NIC), a conservative upper bound is formed using the smallest page granularity supported by the device, or the backend is required to provide a pre-mapping interface that only forms host page mappings and does not generate NIC keys.

[0155] The protection descriptor footprint is recorded separately for the object types of ordinary memory regions, on-demand paging memory regions, memory windows, and indirect memory keys. The queue pair context footprint records at least the transfer type, queue depth, function bits, and expected active state, and does not directly equate the number of queue pairs to a fixed number of bytes.

[0156] In one example, the specific process of the protection descriptor footprint includes: the protection descriptor increment generated for each newly created object. Calculated separately for each object type. A regular fixed memory region uses a memory key to generate a protection descriptor entry. The on-demand paging memory region also uses a single memory key. However, its access mode should be marked as potentially involving additional firmware operations caused by page faults. When using memory windows, the underlying memory region itself generates one protection descriptor entry, and each bound memory window generates an additional protection descriptor entry, for a total of: ; In the formula, To bind to the The number of memory windows for each basic memory region. The indirect memory key generates a corresponding number of protection descriptor entries based on its index level. It is equal to the index depth of the indirect key.

[0157] ask Total increment on the protection descriptor axis for: ; In the formula, For the request The set of memory regions involved.

[0158] In one example, the process of calculating the context footprint for each queue specifically includes: the context increment generated for each newly created queue. This depends on the queue pair type and function bits. Internally, the network interface card (NIC) maintains a transmit queue context and a receive queue context for each queue pair; in most implementations, these are merged and stored as a single queue pair context entry. For connections using a shared receive queue, the receive queue context is shared across multiple queue pairs, reducing the independent context increment for each individual queue pair. Definition: ; In the formula, The recommended scaling factor for the context increment of queue pairs using a shared receive queue relative to standard queue pairs is 0.5 to 1. The specific value is calibrated through differential experiments using queue pair context probes: While keeping the total number of queue pairs constant, compare the probe response differences when using independent receive queues and when using shared receive queues. If the difference is not significant, Set to 1; if the response rate decreases significantly when using a shared receive queue, Reduced according to the response ratio.

[0159] For transport types that support dynamic link targets, a single dynamic link target may correspond to multiple buffer contexts. Calculated based on the probe calibration coefficient for this transmission type.

[0160] ask Total increment on the queue pair context axis for: .

[0161] For the request The set of queue pairs involved.

[0162] S23. Read the original architecture footprint, resource axis response curve, and calibration epoch. Using the axis conversion relationship in the current calibration epoch, convert the number of architecture objects of different vendor formats into probe equivalent units on their respective resource axes to obtain the request multidimensional equivalent footprint: ; In the formula, This represents the equivalent increment of the translation descriptor. This indicates the equivalent increment of the protection descriptor. This represents the equivalent increment of the queue to the context; T This indicates transpose.

[0163] The three coordinates remain independent and are not directly added together. For untrusted tenants or unknown access patterns, the translation descriptor axis is generated according to the upper bound of random access across the entire memory region, and the queue pair context axis is generated according to the upper bound of all new queue pairs that may be active.

[0164] In one example, the calibration method for the axial conversion factor includes: requesting a multidimensional equivalent footprint. In this context, the physical meaning of each component is: the potential number of on-chip cache entries that may be added to the corresponding resource axis after the request is accepted. The probe response curve is calculated in step S13 using the probe's equivalent working set. The independent variable was measured, where, For different page numbers accessed by the probe. For different memory regions or memory keys used by the probe, The number of different queue pairs activated for probe rotation. Each probe object generates a corresponding cache entry of type on-chip, so the unit of the probe equivalent working set is the number of potential cache entries.

[0165] When tenant objects and probe objects generate cache entries of the same type and granularity on-chip, the axial conversion factor is one, and no additional conversion is required. ; When the cache entry granularity of tenant objects and probe objects differs (e.g., some network interface cards use different sized context entries for queue pairs of different transmission types), an axial conversion factor is introduced. , defined as the ratio of cache usage generated by this type of tenant object to cache usage generated by a single probe object: ; In the formula, For the first The equivalent occupancy of a single cache entry for an object on the axis; For the j-th tenant object on the k-th resource axis, the equivalent cache entries generated by a single object are: This represents the equivalent cache entry usage of a single probe object on the k-th resource axis. After conversion: ; In the formula, For the request In the Equivalent footprint increment on each resource axis For the first The original increment of an object before conversion.

[0166] Axial conversion factor There are two ways to obtain the ratio. The first is the lookup table method: when the device documentation or driver interface provides the memory entry size for each type of object, the ratio is calculated directly. The second is the calibration method: in step S13, response curve scanning is performed on different object types, the response differences of different types of objects under the same cache pressure are compared, and the equivalent ratio is calculated based on the difference results.

[0167] When the device documentation does not provide entry sizes and categorization cannot be performed, all conversion factors are conservatively bounded to one, which means that each tenant object generates at least the same amount of cache pressure as a probe object.

[0168] S24. Read the multidimensional equivalent footprint, shadow footprint ledger, and lower bound of resource axis capacity of the request, calculate the occupancy risk of each resource axis after accepting the request, and obtain the model gate judgment result and the pre-occupancy result of the pending quota.

[0169] R =max k∈{T，P，Q} [(X k +Δx , k +G k ) / C k ]; In the formula, X k Δx is the upper bound of the occupancy of committed objects and other pending transactions on the k-th resource axis. , k G is the upper bound of the footprint requested in this case. k To protect the margin, C k R is the lower bound of capacity. For dimensionless risk; T is the translation axis; P is the protection axis; Q is the queue axis.

[0170] When R When R ≥ 1, no large probe pressure that might approach the cliff point is applied; the process directly proceeds to object rewriting or rejection. When the value is less than 1, write the pending quota pre-allocation and enter the request-level pre-rehearsal.

[0171] Model gates are only a necessary condition. The three resource axes may share caches or have overlapping effects, therefore, it's not sufficient to rely solely on R... Even with approval of the request, a joint stress rehearsal must still be conducted.

[0172] S3, Perform a counterfactual stress rehearsal of the request shape matching.

[0173] The system reads the multidimensional equivalent footprint of the request, the pre-created orthogonal probe library, the model gate determination result, and the current calibration epoch. It generates a probe activation sequence corresponding to the shape of this request and determines the cliff risk of the request by considering the baseline, pressure, and recovery staggered periods, thus obtaining the pre-simulation determination result.

[0174] S31. Read the multidimensional equivalent footprint of the request, pre-create the orthogonal probe library and resource axis response curve, select the probe page set, memory key set and queue pair set corresponding to the translation descriptor increment, protection descriptor increment and queue pair context increment respectively, and combine them into a probe activation sequence that maintains the three-axis ratio to obtain the probe activation sequence.

[0175] For requests that may be affected by cache group mapping, perform the same footprint rehearsal using multiple pseudo-random page replacement seeds, take the upper bound of the perturbation, and avoid a single address mapping accidentally falling into a low-conflict cache group.

[0176] Request-level rehearsals for the same physical network interface card are scheduled by a single scheduler to prevent multiple rehearsals from applying pressure simultaneously and making attribution impossible.

[0177] Specifically, the probe activation sequence maps the requested multidimensional equivalent footprint to a specific probe activation sequence according to the following rules.

[0178] Translation descriptor axis direction: Selected from a pre-created large memory region A set of 12 distinct page indices constitutes the translation page activation set. The page indices are generated using pseudo-random permutations to prevent specific address mappings from accidentally falling into the same cache group. It is recommended to use at least three different pseudo-random seeds to perform pre-runs with the same footprint, taking the maximum value of each round's response as the upper bound of the perturbation.

[0179] Protect descriptor axis direction: Select from a pre-created pool of small memory regions These different memory regions constitute the active set of protection descriptors.

[0180] Queue pair context axis direction: Select from the pre-created queue pair pool A set of distinct queue pairs constitutes the active queue pair set. The selected queue pairs distribute sending operations evenly during the stress period, ensuring that the total bandwidth, packet rate, and number of requests in transit remain consistent with the baseline period.

[0181] During joint activation, probes on all three axes are applied simultaneously to capture the cross-effects of shared buffers. The total probe bandwidth does not exceed 5% to 10% of the physical link bandwidth to avoid network layer congestion caused by the probes themselves.

[0182] The recommended duration for a single baseline, stress, or recovery period is between 100 and 500 milliseconds. The lower bound of this range is determined by the sampling statistical precision: targeting the 99th percentile requires at least 1000 request completion samples; for a workload of 10,000 requests per second, 100 milliseconds is sufficient. The upper bound is determined by the tenant's tolerable object creation latency.

[0183] A complete baseline, stress, and recovery staggered rehearsal consists of at least three rounds of random staggering, each round containing a baseline period, a stress period, and a recovery period, with a total duration of approximately 1 to 5 seconds. For typical memory region registration or queue pair creation operations, the control path latency itself is on the order of milliseconds to tens of milliseconds, and the additional rehearsal latency of one to five seconds is acceptable in resource admission scenarios. If tenants set stricter timeout limits, the number of staggered rounds can be reduced to a minimum of 3 rounds, but not less than 3 rounds, as less than 3 rounds of staggering is insufficient to distinguish stress effects from monotonous background trends.

[0184] S32. Read the probe activation sequence, probe stable baseline, and current operating indicators; activate a fixed small-scale baseline probe set; collect tail latency, request completion rate, sentinel throughput, network bandwidth, packet rate, and peripheral interconnect bus load to obtain the baseline sample set and baseline promiscuous status. The sentinels are fixed small-scale queue pairs with the lowest priority, sending fixed-length messages at a fixed rate not exceeding one percent of the physical link bandwidth.

[0185] If abnormal congestion, a sudden increase in complex control operations, or changes in device fingerprints occur during the baseline period, the current rehearsal will be suspended, and abnormal samples will not be used as the basis for requesting access.

[0186] S33. Read the probe activation sequence, baseline sample set, and baseline mixed state. Add the active set of pre-created probe objects step by step according to the probe activation sequence. In the online phase, only send data or perform read operations, without creating or deregistering probe objects, to obtain the stress sample set, stress mixed state, and early stop flag.

[0187] The pressure increase should be stopped immediately when the probe response slope reaches the warning condition, the sentinel tail latency exceeds the protection threshold, or the promiscuous index changes exceed the allowable range. When promiscuous behavior occurs, the current round of samples is marked as unusable for admission and is not interpreted as a change in on-chip cache caused by this request. The allowable range is: the relative change in network bandwidth and packet rate does not exceed 10%, and the relative change in the number of requests in transit does not exceed 10%.

[0188] The early stopping determination uses the same slope threshold as in step S13. and delay threshold During pressure application, the increase in probe pressure should be stopped immediately when the following conditions are met simultaneously: ; ; In the formula, For the probe equivalent working set, subscript (Current pressure point) and (Baseline time period) represents two pressure points respectively. The sequence number of the historical pressure points within the sliding window. For the width of the sliding window, This means taking the median of the set. Increase the probe size for this resource axis; The slope of the discrete response at the current pressure point; For robust tail delay under the current pressure point; This represents the robust tail delay under baseline conditions.

[0189] When the above conditions are triggered in the first micro-period of pressure application, it indicates that the current system state is approaching the cliff point. This simulation will directly output an unsafe judgment and will not continue to collect pressure samples.

[0190] During joint pressure application, if any one of the three axes triggers an early stop condition, the pressure on all axes stops synchronously, and the entire system enters the recovery period. Early stop does not mean failure to enter the system; rather, the collected pressure samples are marked as early stop samples. In step S35, when calculating the disturbance, the early stop samples are treated as a conservative high disturbance estimate.

[0191] S34. Read the pressure sample set, early stop marker and probe activation sequence, stop the joint pressure set and restore the fixed small-scale baseline set, collect the performance response during the recovery period, and obtain the recovery sample set and recovery confirmation results.

[0192] The stress response is considered reversible only when tail latency, throughput, and request completion rate return to the baseline confidence range. Failure to recover indicates potential network congestion, firmware state stagnation, or other persistent anomalies; in this case, the admission result is set to uncertain, and no real object creation is performed.

[0193] S35. Read the baseline sample set, pressure sample set, recovery sample set, baseline mixed state, pressure mixed state, early stop mark, recovery confirmation result and model gate judgment result. Calculate the relative perturbation for the multiple rounds of randomly interleaved baseline, pressure and recovery samples, and form a one-sided upper confidence boundary to obtain the pre-play judgment result.

[0194] For example, the relative perturbation in the g-th round of staggered rehearsals is: ; In the formula, For the m-th observed indicator, the sample during the baseline period, For the sample corresponding to the pressure period, q0. 99 It is the 99th percentile. This represents a dimensionless relative perturbation. Here, r is the request identifier, g is the staggered rehearsal round, and m is the observation index number.

[0195] For multi-round staggered rehearsals, block resampling that maintains time correlation is used to calculate the one-sided upper confidence bound of the relative perturbation. A rehearsal is deemed safe only if the following conditions are met simultaneously: R <1, and one-sided upper confidence boundary <Disturbance detection threshold θ ρ The recovery was confirmed and the sample was free of contamination; the perturbation threshold θ was also confirmed. ρ Take a value of 5% to 15%; α is the significance level, and its value is set according to the required confidence level.

[0196] Model gates prevent short-term probes from missing detections, joint stress simulations correct shared cache and nonlinear cross-effects that static ledgers cannot describe, and recovery confirmations prevent persistent failures from being mistaken for reversible cache stress.

[0197] The block size for block resampling can be determined based on the autocorrelation characteristics of the sample sequences. In one example, the block size selection method includes considering that the tail-delay samples within the baseline, stress, and recovery periods are temporally correlated, and independent resampling would underestimate the confidence bound width. Block resampling preserves temporal correlation, and its block size... The block size should satisfy the requirement that the autocorrelation of the samples within the block has sufficiently decayed. It is recommended to select the block size according to the following rule: calculate the autocorrelation function using the sample sequence from the baseline period, and take the number of lags at which the autocorrelation coefficient first drops below 0.05 as the block size. When the sample sequence is too short to reliably estimate the autocorrelation function, it is recommended to take the square root of the number of sampling periods as the block size.

[0198] In multiple rounds of staggered rehearsals, the relative perturbations in each round The one-sided upper confidence boundary is calculated using the block resampling method described above. When the total number of rehearsals is staggered... When using The confidence bounds are calculated by substituting the normal distribution for the normal distribution to compensate for small sample bias.

[0199] S4. Based on the pre-run results, execute the handle to return to the previous atom access.

[0200] Read pending admission transactions, pre-determined judgment results, request multi-dimensional equivalent footprints and shadow footprint ledgers, and complete the approval, rewriting or rejection before the tenant has obtained the object handle, to obtain the admission results and the updated shadow footprint ledger.

[0201] S41. Read the model gate decision results, pre-demonstration decision results and pending admission transactions, and generate acceptance, rewrite, delay or rejection decisions according to model risk, upper confidence bound of perturbation, recovery state and promiscuous state to obtain the final admission decision.

[0202] If the model gate fails, the probe result cannot be used for reverse approval. If the recovery confirmation fails or the sample is marked as confounding, the request will not be considered safe; it can be delayed and retried, or a hard upper bound can be used for rejection.

[0203] S42. Read the final admission decision, pending quota reservation and pending admission transaction. Under the condition of acceptance, first write the ready to commit status, and then call the real backend control operation. After the backend is successfully created, convert the pending quota to the committed quota and update the object lifecycle record. Finally, return the handle to the tenant to get the admission success result and the updated shadow footprint ledger.

[0204] If backend creation fails, pending quotas are cancelled without returning a handle. If a controller failure occurs between successful backend creation and ledger commit, the recovery process identifies unexposed objects based on pre-write records and chooses to complete the ledger commit or destroy the orphaned objects.

[0205] The atomicity here refers to the atomicity of the tenant-visible state, and does not claim that the network interface card control operation and the host ledger constitute a single atomic instruction at the hardware level.

[0206] S43. Read the final admission decision, request the multi-dimensional equivalent footprint and the semantic constraints of the original object, determine the resource axis with the greatest risk when rewriting is allowed, and generate a candidate registration form that does not change the necessary access permissions and communication semantics, obtain the rewriting object request, and send it back to step S21.

[0207] When the translation descriptor axis is dominant, larger pages or pre-registered buffer pools are used only when the buffer has not yet been exposed to the far end, reallocation is supported, and alignment conditions are met; on-demand paging is considered only when sparse access is possible and tail-of-page delays are acceptable.

[0208] When the protection descriptor axis is dominant, adjacent small memory regions with consistent permissions can be merged and sub-regions can be exposed using a protected memory window, but the protection descriptor cost of the memory window and the key itself must be recalculated.

[0209] When queues dominate the context axis, logical queue pairs are used for multiplexing or active leases only if ordering, reliability, congestion control, and fault isolation semantics can be maintained. Reducing the transmission rate cannot be considered as reducing the queue pair context footprint.

[0210] A request to rewrite an object must have its footprint recalculated and be re-rendered; it is not approved simply because a certain rewrite action is performed.

[0211] S44. Read the final admission decision and candidate rewriting results. When the request does not allow rewriting, there are no candidate methods that meet the semantic constraints, or re-replay is still not safe, cancel the pending quota and return a clear reason for delay or rejection, and obtain the admission failure result and the restored shadow footprint ledger.

[0212] S5. Perform operational calibration and verification and record-keeping closure.

[0213] Read the admission results, the updated shadow footprint ledger, the current calibration epoch, and the operational sentinel data; identify device state drift and maintain object lifecycle consistency; and obtain closed-loop calibration input and final object lifecycle records.

[0214] S51. Read the admission success result, the updated shadow footprint ledger and runtime sentinel data, record the tail latency, throughput, cache-related device-level indicators and object activity status after object creation, and obtain the runtime observation record.

[0215] Running observation logs is used to verify whether the pre-simulation results are consistent with the response direction after the real object is created, and is not used to retroactively destroy objects that have been exposed to tenants.

[0216] S52. Read the operation observation record, current device fingerprint and resource axis response curve, compare the device fingerprint, fixed sentinel response and historical confidence range to obtain the calibration validity result.

[0217] When the device fingerprint changes, the probe coupling relationship disappears, or the fixed sentinel response continues to exceed the calibration range, the calibration epoch will be marked as invalid, and new flexible pre-simulation access will be suspended.

[0218] S53. Read the calibration validity results, running observation records and final object lifecycle records. Deduct the ledger occupancy for objects that have been normally deregistered or destroyed. Perform ledger reconciliation with backend objects for abnormal objects. Write the valid observations into the next round of calibration samples to obtain the closed-loop calibration input and the shadow footprint ledger after the closed-loop update.

[0219] Closed-loop calibration input feedback steps S11 to S14. Operational drift primarily constrains subsequent new applications; for exposed objects, only pre-agreed rate limits, migrations, or downgrades are performed, and active objects are not arbitrarily destroyed.

[0220] In some embodiments, the three-dimensional multidimensional equivalent footprint treats the translation descriptor, protection descriptor, and queue pair context as independent coordinate axes. This modeling assumption holds under the condition that the network interface card (NIC) uses independent or weakly interactive on-chip cache regions for the three types of metadata. When the NIC uses a unified cache to store all interface configuration memory types, cache replacement contention exists between the three axes, and single-axis modeling is approximate.

[0221] According to one aspect of this application, independently calculating the risk ratio for the three resource axes is to simplify the calculation of the model gate, which is a modeling approximation. When the network interface card (NIC) uses a unified on-chip cache to store translation descriptors, protection descriptors, and queued context, adding a working set for one axis may replace a cache entry for another axis, resulting in a single-axis risk not reaching 1 but the joint working set crossing the safety boundary. Therefore, the model gate is only used as a necessary condition for pre-screening, not as a sufficient condition. In step S3, the joint stress pre-simulation simultaneously activates the probes for the three axes, and its stress response naturally includes the cross-substitution effect of the shared cache, serving as a correction mechanism for the independent modeling of the three axes.

[0222] In this embodiment, the total bandwidth and duration of the probe pressure period are constrained to a range that does not affect the normal operation of the service.

Claims

1. A method for access control of network interface card (NIC) resources, characterized in that, include: Receive a creation request for a target object containing architecture information, suspend the actual backend creation action for the target object, and establish a pending admission transaction. Based on the architecture information, a resource footprint transformation is performed to obtain a multi-dimensional equivalent footprint representing the on-chip metadata resource pressure. Based on the pre-constructed orthogonal probe library and the multidimensional equivalent footprint, the probe activation sequence corresponding to the shape of the multidimensional equivalent footprint is determined, and the counterfactual pressure pre-simulation is performed using the probe activation sequence to obtain the pre-simulation judgment result. Based on the pre-judgment results and the pending admission transactions, a final admission decision is generated, and before returning the object handle to the requester, the corresponding admission or rejection operation is performed on the target object based on the final admission decision.

2. The method according to claim 1, characterized in that, The multidimensional equivalent footprint includes the translation descriptor equivalent increment, the protection descriptor equivalent increment, and the queue to context equivalent increment; The process of transforming the resource footprint based on the aforementioned architecture information to obtain a multi-dimensional equivalent footprint representing the on-chip metadata resource pressure specifically includes: Based on the architecture information, the memory access range of the target object is determined, and the equivalent increment of the translation descriptor is calculated. Based on the architecture information, the permission configuration form of the target object is determined, and the equivalent increment of the protection descriptor is calculated. Based on the architecture information, the transmission connection type of the target object is determined, and the context equivalent increment of the queue is calculated.

3. The method according to claim 2, characterized in that, Before performing a counterfactual stress simulation using the probe activation sequence, the procedure also includes: Obtain the pre-stored lower bounds of the capacity of each resource axis and the currently maintained shadow footprint ledger; Extract the existing resource occupancy status based on the shadow footprint ledger; Based on the existing resource occupancy status, the multidimensional equivalent footprint, the pre-configured protection margin, and the lower bound of the capacity of each resource axis, calculate the occupancy risk value of the corresponding resource axis. Security pre-screening is performed based on the occupancy risk value, and when the occupancy risk value meets the preset security conditions, the step of performing counterfactual stress simulation using the probe activation sequence is allowed.

4. The method according to claim 1, characterized in that, The process of determining the probe activation sequence corresponding to the multidimensional equivalent footprint shape specifically includes: Obtain multiple pre-configured pseudo-random permutation seeds; Based on the multiple pseudo-random permutation seeds and the multidimensional equivalent footprint, a mapping combination is performed to generate probe activation sequences with spatial distribution differences.

5. The method according to claim 4, characterized in that, The counterfactual stress simulation is performed using the probe activation sequence to obtain the simulation result, specifically including: Baseline, stress, and recovery periods are applied separately according to an alternating time sequence; A preset size set of active probes is maintained during the baseline period and the recovery period, and performance samples during the baseline period and the recovery period are collected respectively. During the pressure period, an equivalent pressure is applied according to the probe activation sequence with spatial distribution differences, and performance samples during the pressure period are collected.

6. The method according to claim 5, characterized in that, The method of performing counterfactual stress simulation using the probe activation sequence to obtain simulation results also includes: Based on the baseline period performance samples and the stress period performance samples, the relative time delay perturbation is calculated; A block resampling method with sustained time correlation characteristics is adopted, and an upper confidence bound is calculated based on the relative time delay disturbance; When the upper confidence bound satisfies the preset perturbation threshold and the performance sample of the recovery period returns to the confidence interval of the performance sample of the baseline period, the pre-simulation judgment result representing safety is generated.

7. The method according to claim 1, characterized in that, The final admission decision includes an admission decision, a denial decision, and a rewrite permission decision; during the process of performing corresponding admission or denial operations on the target object based on the final admission decision, when the final admission decision is the rewrite permission decision, it specifically includes: The dominant resource axis is determined based on the ratio of each component in the multidimensional equivalent footprint to the capacity of the corresponding resource axis. A rewrite object request is generated based on the resource constraints corresponding to the dominant resource axis, while maintaining the original communication semantics of the target object; The rewritten object request will trigger the step of re-triggering the resource footprint transformation based on the architecture information.

8. The method according to claim 1, characterized in that, The orthogonal probe library is pre-built through the following steps: Create probe objects during the system initialization phase; During the online phase of the business, the probe objects are constrained to only change the active set of probes by sending or reading data, so as to avoid triggering the registration or deregistration actions of the probe objects, thus obtaining the pre-built orthogonal probe library.

9. The method according to claim 8, characterized in that, Before obtaining the pre-built orthogonal probe library, a step of performing cross-coupling verification is also included: Apply probe access pressure to the physical function side and collect tail delay samples from the corresponding virtual function side; Based on the increase of the tail delay sample relative to the stress-free baseline, it is determined whether the physical function side and the virtual function side share the target cache level, and the probe coupling verification result is obtained. Based on the successful probe coupling verification results, the construction of the orthogonal probe library is confirmed to be complete.

10. The method according to claim 1, characterized in that, Before returning the object handle to the requester, after performing the corresponding admission operation on the target object based on the final admission decision, the process further includes: Periodically collect operational observation responses and current equipment fingerprints; Based on the operational observation response and the current device fingerprint, identify device state drift. Based on the device state drift, the consistency of the object's lifecycle is maintained, resulting in a closed-loop updated shadow footprint ledger.

Images