Page table updating method, server, graphics processing unit, chip, and storage medium

Abstract

The present application provides a page table updating method, a server, a graphics processing unit, a chip, and a storage medium. The page table updating method is applied to the server, and the server runs a first drive and a second drive. The method comprises: when a jumping mechanism is triggered by means of the first drive, verifying, by means of the second drive, the content of a page table to be updated that is written by the first drive into a first storage space, so as to obtain a verification result, the verification result being used for indicating whether said page table is credible; and on the basis of the verification result, updating, by means of the second drive, an information table currently maintained by the second drive, so as to obtain a credible information table, the credible information table being used for storing related information of a credible page table. The present application can improve the security of updating the page table.

Description

Page table updating method, server, graphics processor, chip and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on the Chinese patent application with application number 202311159977.3, application date September 8, 2023, and invention name “Page table update method, server, graphics processor, chip, storage medium and computer program product”, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby introduced into this application as a reference. Technical Field

[0003] The present application relates to the field of communication technology, and is related to, but not limited to, a page table updating method, a server, a graphics processor, a chip, and a storage medium. Background Art

[0004] Graphics Processing Unit (GPU) virtualization is the process of partitioning a GPU through hardware and software so that multiple virtual machines (VMs) can share the computing power of the GPU.

[0005] GPU virtualization technology involves a virtual machine manager (VMM) and a virtual machine operating system (OS). Each VM maintains a separate GPU page table, which manages the mapping between the GPU's virtual and physical addresses. However, in related technologies, when a VM updates its own stored GPU page table, other VMs can maliciously modify it, compromising its security.

[0006] Summary of the Invention

[0007] Embodiments of the present application provide a page table update method, server, graphics processor, chip, and storage medium, which can improve the security of updating the page table.

[0008] The technical solution of this application is achieved as follows:

[0009] In a first aspect, an embodiment of the present application provides a page table update method, which is applied to a server, wherein the server runs a first driver and a second driver, and the method includes: when a jump mechanism is triggered by the first driver, the second driver verifies the content of the page table to be updated written by the first driver in the first storage space to obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible; based on the verification result, the second driver updates the information table currently maintained by it to obtain a credible information table; the credible information table is used to store relevant information of the credible page table.

[0010] In a second aspect, an embodiment of the present application provides a page table update method, which is applied to a graphics processor, wherein the graphics processor runs a third driver, and the method includes: obtaining a verification result through the third driver; wherein the verification result is used to indicate whether the content of the page table to be updated is credible; the verification result is notified to the third driver by the second driver in the form of a task; based on the verification result, the third driver updates the information table currently maintained by the third driver to obtain a credible information table; the credible information table is used to store relevant information of the credible page table.

[0011] In a third aspect, an embodiment of the present application provides a server, comprising a first driver part and a second driver part; wherein, the first driver part is configured to, when a jump mechanism is triggered by the first driver, verify the contents of the page table to be updated written by the first driver in the first storage space through the second driver to obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible; the second driver part is configured to update the information table currently maintained by it through the second driver according to the verification result to obtain a credible information table; the credible information table is used to store relevant information of the credible page table.

[0012] In a fourth aspect, an embodiment of the present application provides a graphics processor, the graphics processor including a third driving part; wherein,

[0013] The acquisition part is configured to obtain a verification result through the third driver; wherein, the verification result is used to indicate whether the content of the page table to be updated is credible; the verification result is notified to the third driver by the second driver in the form of issuing a task; according to the verification result, the information table currently maintained by the third driver is updated to obtain a credible information table; the credible information table is used to store relevant information of the credible page table.

[0014] In a fifth aspect, an embodiment of the present application provides a server, comprising: a first processor and a first memory, wherein the first memory is used to store a computer program, and the first processor is used to call and run the computer program stored in the first memory to execute the page table update method on the server side.

[0015] In a sixth aspect, an embodiment of the present application provides a graphics processor, comprising: a second processor and a second memory, wherein the second memory is used to store a computer program, and the second processor is used to call and run the computer program stored in the second memory to execute a page table update method on the graphics processor side.

[0016] In a seventh aspect, an embodiment of the present application provides a chip, comprising: a processor, configured to call and run a computer program from a memory, so that a device equipped with the chip executes a method for updating a page table on a server side; or, executes a method for updating a page table on a graphics processor side.

[0017] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, the method for updating the page table on the server side is implemented; or, the method for updating the page table on the graphics processor side is implemented.

[0018] The embodiment of the present application provides a page table update method, server, graphics processor, chip and storage medium, which are applied to the server, and the server runs a first driver and a second driver. The method includes: first, when the jump mechanism is triggered by the first driver, the second driver verifies the content of the page table to be updated written by the first driver in the first storage space to obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible; then, based on the verification result, the second driver updates the information table currently maintained by it to obtain a credible information table; the credible information table is used to store relevant information of the credible page table. When the server triggers the jump mechanism through the first driver, the second driver verifies the page table to be updated. In this way, it can be ensured that the first driver cannot update the page table by itself and can only entrust the second driver to update the page table. Compared with directly updating the page table through the first driver, the embodiment of the present application can improve the security of the page table update. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Embodiments of the present application will now be described in more detail and with reference to the accompanying drawings, in which:

[0020] FIG1 is a flowchart diagram 1 of an optional page table updating method provided in an embodiment of the present application;

[0021] FIG2 is a second flow chart of an optional page table updating method provided in an embodiment of the present application;

[0022] FIG3 is a first schematic diagram of an optional communication mechanism between a first driver and a second driver provided in an embodiment of the present application;

[0023] FIG4 is a third flow chart of an optional page table updating method provided in an embodiment of the present application;

[0024] FIG5 is a schematic diagram of an optional basic check provided in an embodiment of the present application;

[0025] FIG6 is a fourth flow chart of an optional page table updating method provided in an embodiment of the present application;

[0026] FIG7 is a schematic diagram of an optional full-link verification provided in an embodiment of the present application;

[0027] FIG8 is a schematic diagram of an optional supplementary check provided in an embodiment of the present application;

[0028] FIG9 is a second schematic diagram of an optional communication mechanism between a first driver and a second driver provided in an embodiment of the present application;

[0029] FIG10 is a fifth flow chart of an optional page table updating method provided in an embodiment of the present application;

[0030] FIG11 is a schematic diagram of an optional communication mechanism among a first driver, a second driver, and a third driver provided in an embodiment of the present application;

[0031] FIG12 is a first schematic diagram of an optional interaction among a first drive, a second drive, and a third drive provided in an embodiment of the present application;

[0032] FIG13 is a second schematic diagram of an optional interaction among the first drive, the second drive, and the third drive provided in an embodiment of the present application;

[0033] FIG14 is a first structural diagram of an optional server provided in an embodiment of the present application;

[0034] FIG15 is a first structural diagram of an optional graphics processor provided in an embodiment of the present application;

[0035] FIG16 is a second structural diagram of an optional server provided in an embodiment of the present application;

[0036] FIG17 is a second structural diagram of an optional graphics processor provided in an embodiment of the present application;

[0037] FIG18 is a schematic diagram of the structure of an optional chip provided in an embodiment of the present application;

[0038] Figure 19 is a schematic block diagram of an optional communication system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] To make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the specific technical solutions of the present application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application but are not intended to limit the scope of the present application.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0041] In the following description, references to “some embodiments,” “this embodiment,” “embodiments of the present application,” and examples, etc., describe a subset of all possible embodiments. However, it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict.

[0042] GPU virtualization is to use some kind of software and hardware segmentation technology to split the GPU so that multiple virtual machines can share the computing power of the GPU. At present, the security of GPU virtualization is not considered in the relevant technology. The chip lacks a two-stage GPU memory management unit (Memory Management Unit, MMU) or a hardware module with similar functions, which allows VMs to access the data of other VMs through the GPU, bringing serious security issues. Among them, the MMU is used to manage the address translation and access permission control of the GPU accessing the system memory. The two-stage GPU MMU generally refers to the GPU's memory management unit using a two-level address translation structure. The first-level MMU is responsible for converting the GPU virtual address to the GPU physical address, and the second-level MMU is responsible for converting the GPU physical address to the system physical address, thereby providing more flexible address mapping and finer-grained permission control. Therefore, if the GPU chip lacks a two-stage GPU MMU, it may cause some limitations and problems, including:

[0043] 1) Address mapping limitations: The lack of a two-stage MMU may limit the size and mapping method of the GPU address space, and may not be able to effectively utilize system memory resources;

[0044] 2) Limitations in access control: The lack of a two-stage MMU may result in insufficient granularity in access control, making it difficult to implement flexible access control over different memory areas.

[0045] 3) Performance limitation: A two-stage MMU can distribute the address translation task to two levels of MMU, thereby improving the efficiency and performance of address translation. Therefore, the lack of a two-stage MMU may lead to performance degradation.

[0046] Currently, the standard solution for virtualized GPUs (Virtual Graphics Processing Unit, vGPU) includes a virtualization manager (VMM) and a client operating system (VM), where each VM needs to maintain an independent GPU page table. The GPU page table is a data structure used to manage the mapping relationship between the virtual address and physical address of the GPU. The GPU page table is similar to the page table in the operating system, but is optimized for the specific needs of the GPU. The GPU page table is used to convert the virtual address used by the GPU program into the actual physical address to access the data stored in the GPU memory. When a GPU program accesses a virtual address, the GPU page table will look up the corresponding location of the address in the physical memory and map the access operation to the correct physical address.

[0047] Furthermore, a GPU page table is typically composed of page table entries, each of which contains a virtual address and a corresponding physical address. Page table entries can also contain other related information, such as access permissions, caching policies, etc. GPU page tables can be hierarchical structures containing multiple levels of page tables to support a larger address space and more efficient address translation. By using GPU page tables, the GPU can implement virtual memory management, provide a larger address space, memory isolation and security, and support concurrent execution of multiple tasks.

[0048] In related technologies, conventional GPU three-level page tables include: a first-level page table (PC), a second-level page table (PD), and a third-level page table (PT). Specifically, the PC includes multiple PD entries. The PC maps the high-order portion of the virtual machine address to the corresponding PD; the PD maps the middle-order portion of the virtual address to the corresponding PT; and the PT contains multiple page table entries, each of which corresponds to a page of the virtual address and records the location information of the page in the physical address space.

[0049] When a GPU program accesses a virtual address, the GPU searches for the corresponding page table entries in sequence according to the hierarchical structure to find the physical address corresponding to the virtual address. First, the GPU searches the first-level page table PC and finds the address of the second-level page table PD based on the high bits of the virtual address. Then, it continues searching in the second-level page table PD and finds the address of the third-level page table PT based on the middle bits of the virtual address. Finally, it finds the physical address corresponding to the virtual address in the third-level page table PT. By introducing the three-level page table, the GPU can support a larger address space to meet the needs of large-scale data processing and computing. In addition, the three-level page table can also improve the efficiency of address translation, reduce storage overhead, and support more flexible address mapping strategies to optimize the performance and memory management capabilities of the GPU.

[0050] It should be noted that the specific addresses and contents of the first-level page table PC, second-level page table PD, and third-level page table PT are allocated by the operating system. When the operating system issues a task, it carries the header address information of the GPU page table, which is named PCROOT here. PCROOT is the starting address of the page table. It is a pointer or reference to the starting table entry of the first-level page table. In order to inform the GPU of the location of the first-level page table used by the task, the scheduling processing chip inside the GPU will process the PCROOT when it receives the task from the operating system VM to schedule the GPU chip to work.

[0051] However, in related technologies, when the operating system sends tasks to the GPU, the GPU will use the page table to read and write data. If a VM is attacked and the GPU page table points to an illegal address, the tasks sent by the operating system to the GPU will cause serious security issues.

[0052] Based on this, an embodiment of the present application provides a page table update method, which is applied to a server, and the server runs a first driver and a second driver. The method includes: first, when the jump mechanism is triggered by the first driver, the server verifies the content of the page table to be updated written by the first driver in the first storage space through the second driver to obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible; then, based on the verification result, the server updates the information table currently maintained by it through the second driver to obtain a credible information table; the credible information table is used to store relevant information of the credible page table. When the server triggers the jump mechanism through the first driver, the server verifies the page table to be updated through the second driver. In this way, it can be ensured that the first driver cannot update the page table by itself and can only entrust the second driver to update the page table. Compared with directly updating the page table through the first driver, the embodiment of the present application can improve the security of the page table update.

[0053] The page table updating method provided in the embodiment of the present application is executed by a server and a graphics processor, wherein the server and the graphics processor are connected via a hardware interface.

[0054] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application.

[0055] FIG1 is a flow chart of an optional page table updating method provided in an embodiment of the present application. As shown in FIG1 , the method includes steps S101 to S102 :

[0056] S101. When a jump mechanism is triggered by a first driver, a second driver verifies the contents of the page table to be updated written by the first driver in the first storage space to obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible.

[0057] In an embodiment of the present application, when the jump mechanism is triggered by the first driver, the server verifies the content of the page table to be updated written by the first driver in the first storage space through the second driver to obtain a verification result.

[0058] In an embodiment of the present application, multiple VM virtual machines are run on a server, each operating system runs a first driver, and a second driver is run on the server, wherein the first driver is a VM driver and the second driver is a VMM driver.

[0059] In the embodiment of the present application, the jump mechanism is a control flow operation during the execution process, which allows the program to jump to another instruction sequence during execution, thereby changing the execution order of the program.

[0060] In the embodiment of the present application, the jump mechanism is also called VM-Exit.

[0061] In some embodiments of the present application, when the jump mechanism is triggered by the first driver, the task process of the first driver is in a suspended state; wherein the task process is related to updating the content of the page table.

[0062] In an embodiment of the present application, when the first driver triggers the jump mechanism (VM-Exit), the task process related to updating the page table content in the VM will be suspended.

[0063] It is understandable that, through the jump mechanism, the second driver can monitor and schedule the operation of the first driver, thereby ensuring the security and stability of the system.

[0064] In an embodiment of the present application, when the first driver triggers the jump mechanism, the second driver verifies the content of the page table to be updated written by the first driver in the first storage space to obtain a verification result indicating whether the page table to be updated is credible.

[0065] In some embodiments of the present application, the method further includes: applying for a first storage space through the first driver; and the first storage space is used for communication between the first driver and the second driver.

[0066] In the embodiment of the present application, the first storage space is applied for by the first driver, and a communication mechanism between the first driver and the second driver can be established through the first storage space.

[0067] In an embodiment of the present application, the first storage space is used to store relevant data of the page table to be updated.

[0068] In the embodiment of the present application, the first storage space is a shared memory of the first driver and the second driver. Exemplarily, the first storage space can be represented as A.

[0069] It is understandable that a communication mechanism between the VM and the VMM can be established through the first storage space to transfer and update page table data, thereby meeting the requirement of the VM system to send the page table data to be updated to the VMM driver.

[0070] It should be noted that the first storage space serves as a data transmission channel between the first driver and the second driver. The first driver can store the relevant data of the page table content to be updated at a specific location in the first storage space A. The relevant data of the page table content to be updated can be organized using a structure, which contains relevant information such as the page table address and page table content.

[0071] Exemplarily, implementing communication between the first driver and the second driver by means of shared memory may include the following steps:

[0072] 1) The server applies for a first storage space A (also called a shared memory area) through the first driver to store the page table to be updated that the VM system wants to update; 2) The server writes the content of the page table to be updated into the first storage space A through the first driver, and can encapsulate the content of the page table to be updated into a structure or other specific data format so that the second driver can correctly parse and process it; 3) The server detects data changes in the first storage space A through the second driver and reads the content of the page table to be updated; 4) The server performs a subsequent verification process on the obtained content of the page table to be updated through the second driver.

[0073] It can be understood that, on the one hand, the communication mechanism between the first driver and the second driver is established by means of shared memory, so that the first driver and the second driver can effectively exchange data, realize the update and management of page table data, and ensure the correctness and consistency of the page table; on the other hand, the communication mechanism established by shared memory can realize data exchange and communication between the first driver and the second driver, and can realize efficient data sharing between the first driver and the second driver, avoiding the overhead of copying data and communication delays.

[0074] It should be noted that in the embodiment of the present application, the communication between the first driver and the second driver can also be achieved through other communication mechanisms (such as socket method). The present application does not impose any restrictions on this, and the specific selection can be made according to the actual application scenario.

[0075] S102 . Based on the verification result, the second driver updates the information table currently maintained by the second driver to obtain a trusted information table; the trusted information table is used to store relevant information of the trusted page table.

[0076] In an embodiment of the present application, after the server verifies the content of the to-be-updated page table of the first storage space through the second driver, the server updates the information table currently maintained by the server through the second driver to obtain a credible information table.

[0077] In an embodiment of the present application, the trusted information table is used to store relevant information of the trusted page table. For example, the trusted information table can store the page table address, page table content, page table root information (PCROOT), etc. of the trusted page table. This application does not impose any restrictions on this.

[0078] In some embodiments of the present application, the trusted information table includes at least: page table root information of the trusted page table.

[0079] In an embodiment of the present application, the page table root information can be represented as PCROOT.

[0080] In an embodiment of the present application, the page table root information PCROOT is used to represent the header address information of the GPU page table (also called the header position). In the GPU page table, the header address information refers to the starting address of the GPU page table, also called the base address of the page table. PCROOT is a pointer or reference to the first table entry of the GPU page table. In other words, the header position of the GPU page table stores the starting address of the page table, and the first table entry of the page table can be accessed through this address. Therefore, through the header position of the page table, the GPU can find the corresponding page table entry according to the index of the virtual address, and then obtain the corresponding physical address to complete the memory access operation.

[0081] In an embodiment of the present application, the information table is also referred to as a PCROOT table. Among them, the PCROOT table is a data structure for managing page tables, which is used to determine the location of the root node (Root Page Table) of each page table in the virtual address space. In a virtualization scenario, each virtual machine (VM) has its own page table for address translation, and the PCROOT table is used to store the root node location of the page table of each virtual machine. The PCROOT table contains multiple entries, each entry corresponding to the page table of a virtual machine. Each entry records the physical address or other identifier of the page table of the virtual machine so that the corresponding page table can be found during address translation. The role of the PCROOT table is to provide a way to centrally manage and search page tables so that the virtualization manager can quickly find and use the correct page table for address translation.

[0082] It should be noted that the header position (PCROOT) of the GPU page table is usually initialized and managed by the operating system or driver. The GPU accesses the page table through the header position when address translation is required.

[0083] In some embodiments of the present application, in S102, based on the verification result, the second driver updates the currently maintained information table to obtain the trusted information table, which may include S1021 to S1022:

[0084] S1021. If the verification result indicates that the page table content to be updated is credible, the second driver adds the page table root information corresponding to the page table content to be updated to the information table currently maintained by the second driver, thereby obtaining a credible information table.

[0085] S1022: When the verification result indicates that the content of the page table to be updated is untrustworthy, the second driver deletes the page table root information corresponding to the content of the page table to be updated in the information table currently maintained by the second driver, thereby obtaining a trustworthy information table.

[0086] In the embodiment of the present application, S1021 and S1022 are parallel schemes, that is, S1021 and S1022 can be executed one by one.

[0087] In an embodiment of the present application, the second driver maintains an information table. If the verification result indicates that the content of the page table to be updated is credible, the second driver adds the page table root information corresponding to the content of the page table to be updated to the currently maintained information table, thereby obtaining a credible information table. Alternatively, if the verification result indicates that the content of the page table to be updated is uncredible, the second driver deletes the page table root information corresponding to the content of the page table to be updated from the currently maintained information table, thereby obtaining a credible information table. In other words, the second driver adds or deletes the page table root information in the currently maintained information table based on the verification result of the content of the page table to be updated, thereby maintaining a credible information table. Subsequent task processing based on the credible information table can improve the security of the page table.

[0088] It can be understood that the second driver verifies the content of the page table to be updated, and updates the information table maintained by the second driver according to the verification result of the content of the page table to be updated, thereby maintaining a trusted information table. This ensures that the content of each page table in the information table has been fully checked and verified, which can effectively prevent the impact of malicious modifications to the page table content on the system, thereby ensuring the stability and security of the system.

[0089] In an embodiment of the present application, a method for updating a page table is provided, the method comprising: first, in the case of triggering a jump mechanism through a first driver, the server verifies the contents of the page table to be updated written by the first driver in the first storage space through a second driver to obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible; then, based on the verification result, the server updates the information table currently maintained by it through the second driver to obtain a credible information table; the credible information table is used to store relevant information of the credible page table. In the case of triggering a jump mechanism through the first driver, the server verifies the page table to be updated through the second driver. In this way, it can be ensured that the first driver cannot update the page table by itself and can only entrust the second driver to update the page table. Compared with directly updating the page table through the first driver, the embodiment of the present application can improve the security of the page table update.

[0090] In some embodiments of the present application, based on Figure 1, as shown in Figure 2, in S102, the implementation after the second driver updates the currently maintained information table according to the verification result to obtain a trusted information table also includes S103: informing the third driver running on the graphics processor of the verification result through the second driver in the form of issuing a task, so that the third driver synchronously updates the currently maintained information table according to the verification result, so that the third driver obtains a trusted information table.

[0091] In the embodiment of the present application, the third driver is a schedule chip driver (Schedule Chip Driver), and the third driver runs on the graphics processor GPU.

[0092] In the embodiment of the present application, after the second driver updates the information table it maintains, the second driver notifies the third driver by issuing a task, so that the third driver also maintains an identical credible information table.

[0093] In an embodiment of the present application, when the members stored in the trusted information table maintained by the second driver (page table root information PCROOT) increase or decrease, it indicates that there are new members or existing members are removed. In this way, in order to ensure the consistency of each part of the entire system, it is necessary to notify the third driver so that the third driver also maintains the same trusted information as the second driver.

[0094] In the embodiment of the present application, the second driver sends a message to the third driver by issuing a task, informing it that it needs to update the information table. In this way, the third driver will update its internal information table accordingly, thereby maintaining consistency with the trusted information table in the second driver.

[0095] In the embodiments of the present application, the method of issuing tasks is generally implemented by establishing a communication mechanism in the system. The specific implementation method depends on the system architecture and application requirements. The following are several common methods of issuing tasks:

[0096] 1) Message Queue: Use the message queue as a channel for task delivery. The second driver can encapsulate task information (such as verification results) into a message and place it in the message queue. The third driver monitors the message queue and processes tasks when they arrive.

[0097] 2) Shared Memory: Task information is transferred via shared memory. The second driver can write task data (such as verification results) to the shared memory area, while the third driver periodically or based on a trigger mechanism checks whether new task data has arrived in the shared memory.

[0098] 3) Event mechanism: The second driver can use the event mechanism to send task notifications to the third driver. This can be achieved through the event notification mechanism provided by the operating system, such as semaphores, event objects, etc.

[0099] 4) Remote Procedure Call (RPC): Use the RPC framework to issue and process tasks. The second driver can use RPC to send task data (such as verification results) to the third driver, which then processes the received task data.

[0100] It should be noted that the above-mentioned method of issuing tasks is only an example. The embodiment of the present application does not impose any limitation on the method of issuing tasks. In actual application scenarios, a suitable communication mechanism can be selected to issue tasks to ensure the reliability and security of communication between the second driver and the third driver.

[0101] It is understandable that each driver in the system maintains the same trusted information, ensuring the correctness and consistency of the conversion from virtual addresses to physical addresses in the entire system, thereby ensuring the security and correct operation of the virtual machine.

[0102] In some embodiments of the present application, the implementation of informing the third driver running on the graphics processor of the verification result by the second driver in a task-issuing manner in S103 includes:

[0103] The verification result is written into the fifth storage space through the second driver, so that the third driver obtains the verification result through the fifth storage space; wherein the fifth storage space is used to realize communication between the second driver and the third driver.

[0104] In the embodiment of the present application, the fifth storage space is a shared memory between the second driver and the third driver, and the fifth storage space is used to enable the second driver (VMM driver) to communicate with the third driver (scheduling chip driver).

[0105] It can be understood that in the embodiment of the present application, the server writes the verification result of the page table content to be updated into the fifth storage space through the second driver, so that the third driver can synchronously update the information table it maintains according to the verification result in the fifth storage space.

[0106] In some embodiments of the present application, the method also includes S104: writing the task instruction into the sixth storage space through the first driver, so that the third driver performs corresponding task processing according to the task instruction obtained in the sixth storage space; wherein the task instruction carries the page table root information of the target page table; the sixth storage space is used to enable the first driver to communicate with the third driver.

[0107] In an embodiment of the present application, after the third driver and the second driver both maintain the same trusted information table, the first driver can issue tasks to the third driver, and the third driver performs corresponding task processing according to the trusted information table it maintains.

[0108] In the embodiment of the present application, the sixth storage space is a shared memory between the first driver and the third driver, and the sixth storage space is used to enable communication between the first driver and the third driver.

[0109] In an embodiment of the present application, when the first driver sends a task (carrying a task instruction) to the third driver, the third driver will determine whether the page table root information carried by the task instruction is a member of the trusted information table; if it is trusted, the third driver will execute the task; if it is not trusted, the third driver will refuse to execute the task.

[0110] In some embodiments of the present application, in S102 , the second driver updates the information table currently maintained by the second driver according to the verification result to obtain a trusted information table. The method also includes: the task process of the first driver is in a running state.

[0111] In the embodiment of the present application, after the server updates the information table currently maintained by the second driver, the first driver will continue to execute the suspended instructions, so that the task process of the first driver is in a running state.

[0112] In some embodiments of the present application, before S101 is implemented by the second driver verifying the to-be-updated page table content written by the first driver in the first storage space and obtaining the verification result, the method further includes:

[0113] Writing the page table content to be updated into the first storage space through the first driver; the first storage space is used for the first driver and the second driver to communicate;

[0114] When the first driver determines that the page table content update condition is met, the jump mechanism is triggered by the first driver.

[0115] In an embodiment of the present application, the page table content to be updated sent by the operating system is written into the first storage space through the first driver (VM driver).

[0116] In an embodiment of the present application, when the page table content to be updated in the first storage space meets the page table content update condition, the jump mechanism is triggered by the first driver.

[0117] In some embodiments of the present application, the content of the page table to be updated includes: the page table to be updated and / or the page table root to be updated, and the method further includes:

[0118] When the number of page tables to be updated in the first storage space meets a preset number threshold, and / or when a page table root to be updated exists in the first storage space, the first driver determines that a page table content update condition is met.

[0119] In the embodiment of the present application, the content of the page table to be updated may be the page table to be updated (Page Table) or the page table root to be updated (PCROOT).

[0120] In the embodiment of the present application, the page table content update conditions are met in the following two situations:

[0121] Case 1: When the page table content to be updated written into the first storage space by the first driver is the page table to be updated, when the number of page tables to be updated meets the preset number threshold, it is determined that the page table content update condition is met; wherein the preset number threshold is a pre-set value, for example, the preset number threshold is 16 page table entries.

[0122] Case 2: When the page table content to be updated written into the first storage space by the first driver is the page table root to be updated, it is determined that the page table content update condition is met.

[0123] If one or both of the above two conditions are met, the jump mechanism is triggered by the first drive.

[0124] In an embodiment of the present application, the content of the page table to be updated entrusted to the first driver by the VM operating system will be stored in the first storage space A. When the number of page tables to be updated in the first storage space A meets the preset number threshold, or when there is a page table root to be updated in the first storage space, the server triggers a jump mechanism through the first driver, namely VM-Exit. At this time, the task process of the first driver is in a suspended state.

[0125] In some embodiments of the present application, the jump mechanism is triggered by the first driver, including:

[0126] The jump mechanism is triggered by accessing the second storage space through the first driver; the first driver has read and write permissions for the second storage space.

[0127] In the embodiment of the present application, the second storage space is exposed to the first driver with readable and writable properties.

[0128] In the embodiment of the present application, the second storage space is a virtual base address register (BAR) space, and the second storage space can be represented as BAR1. The second storage space is a virtual I / O address space configured as readable and writable, that is, the first driver can write data to the second storage space through the second storage space and trigger specific operations (i.e., trigger a jump mechanism).

[0129] In the embodiment of the present application, the second storage space may be a specific address range or a specific register in the system memory, and the address range or register is used as a communication channel between the first driver and the second driver.

[0130] It is understandable that by accessing the second storage space through the first driver, a trigger jump mechanism is implemented, and a communication mechanism between the first driver and the second driver can be established.

[0131] In some embodiments of the present application, the triggering jump mechanism is implemented by accessing the second storage space by the first driver, including:

[0132] The jump mechanism is triggered by reading data of a specific byte in the second storage space through the first driver, and / or writing data into a specific byte in the second storage space through the first driver.

[0133] In an embodiment of the present application, the server writes data or reads data in a specific byte of the second storage space through the first driver to trigger the jump mechanism.

[0134] Exemplarily, the jump mechanism is triggered by the first driver accessing the 64th byte in the second storage space.

[0135] In this embodiment of the present application, when the first driver writes data to the second storage space, this operation immediately triggers a jump mechanism (VM-Exit). At this time, the vCPU currently executing in the first driver is suspended, and control is transferred to the VMM. The VMM captures the VM-Exit event and executes the corresponding code logic to complete the corresponding processing.

[0136] It can be understood that in this way, a communication mechanism is established between the first driver and the second driver, and the first driver can send a request or transmit information to the second driver by writing data to the second storage space. The triggering of the jump mechanism ensures that when the first driver executes the relevant code for page table update, the control can be transferred to the second driver in time to execute the page table check and update processing flow through the second driver. In this way, the second driver can effectively control and manage the operation of the first driver, and communicate and collaborate with the first driver in real time to achieve function expansion and resource management in a virtualized environment.

[0137] In an embodiment of the present application, Figure 3 is a schematic diagram of an optional communication mechanism between the first driver and the second driver provided in an embodiment of the present application. As shown in Figure 3, the server applies for shared system memory (Shared System Memory) between the server and the second driver through the first driver. The shared system memory is the above-mentioned first storage space A. When the first driver determines that the page table content update condition is met, the second storage space (BAR1) is accessed through the first driver, which triggers the jump mechanism. At this time, the task process of the first driver is in a suspended state, and the server performs subsequent verification and update processes on the page table content to be updated in the first storage space through the second driver.

[0138] It can be understood that by caching the page table entries delegated by the operating system in the first storage space and triggering the jump mechanism through the first driver accessing the second storage space, it can ensure that the first driver cannot directly modify the content of the page table to be updated, while ensuring the security and correctness of the page table.

[0139] In some embodiments of the present application, as shown in FIG4 , the implementation of verifying the to-be-updated page table content written by the first driver in the first storage space by the second driver in S101 to obtain the verification result may include S1011 to S1012:

[0140] S1011. When the content of the page table to be updated includes the page table to be updated, perform address verification on the page table to be updated by the second driver; wherein the address verification is used to determine whether the page table address and the pointing address of the page table to be updated are credible.

[0141] S1012: When the page table to be updated passes the address verification, the second driver determines that the verification result of the page table to be updated is credible.

[0142] In the embodiment of the present application, the page table address is the address of the page table content to be updated, and the pointing address is the address pointed to by the page table entry in the page table content to be updated.

[0143] In the embodiment of the present application, the page table to be updated may be a primary page table (PC), a secondary page table (PD), or a tertiary page table (PT).

[0144] In some embodiments of the present application, address verification includes: basic verification; the implementation of address verification of the page table to be updated by the second driver in S1011 may include: performing basic verification of the page table to be updated by the second driver; wherein the basic verification is used to determine whether the page address and the pointing address of the page table to be updated are within the allowed range.

[0145] In some embodiments of the present application, the page table to be updated belongs to any one of the first-level page table, the second-level page table and the third-level page table; wherein, the page table entry in the first-level page table points to the second-level page table, the page table entry in the second-level page table points to the third-level page table, and the page table entry in the third-level page table points to the physical memory space used to store real data.

[0146] In an embodiment of the present application, for a three-level GPU page table, the first-level page table can be represented as PC, the second-level page table can be represented as PD, and the third-level page table can be represented as PT.

[0147] In an embodiment of the present application, the first stage of verification is to perform basic verification on the page table to be updated through the second driver. By performing basic verification on the page table to be updated, it can be determined whether the page address and the pointing address of the page table to be updated are within the allowed range, thereby ensuring that the page table to be updated does not cross the domain and ensuring the basic correctness of the page table to be updated.

[0148] In some embodiments of the present application, the implementation of basic verification of the to-be-updated page table by the second driver may include:

[0149] If the page table to be updated belongs to the first-level page table or the second-level page table, then when the page address and the pointing address of the page table to be updated are within the address range of the third storage space, the second driver determines that the page table to be updated passes the basic check; wherein the third storage space is the storage space applied for by the second driver for storing the page table; or,

[0150] If the page table to be updated belongs to the third-level page table, then when the page address of the page table to be updated is within the address range of the third storage space, and the address pointed to by the page table to be updated is within the address range of the fourth storage space, the second driver determines that the page table to be updated passes the basic check; wherein the fourth storage space is a physical memory space used to store real data.

[0151] In an embodiment of the present application, the third storage space is used to store the page table content to be updated.

[0152] In the embodiment of the present application, the third storage space has a non-readable and non-writable permission for the first driver. This ensures that the first driver cannot write the updated page table content into the third storage space, and further ensures that the first driver cannot modify or access the page table on its own. All page table update operations must be managed and controlled by the second driver, thereby ensuring the security and stability of the virtual machine.

[0153] In the embodiment of the present application, the third storage space can be represented as BAR4.

[0154] In some embodiments of the present application, the fourth storage space includes a frame buffer space (Frame Buffer) and / or a system memory space (System Memory).

[0155] For example, FIG5 is a schematic diagram of an optional basic check provided by an embodiment of the present application. As shown in FIG5 , for the GPU three-level page table, the page table address in the first-level page table PC and the address pointed to by its page table entry are both within the address range of the third storage space (BAR4), the page table address in the second-level page table PD and the address pointed to by its page table entry are both within the address range of the third storage space (BAR4), the address in the third-level page table PT is within the address range of the third storage space (BAR4), and the address pointed to by the page table entry in the third-level page table PT is within the address range of the fourth storage space. Wherein, the fourth storage space includes the frame buffer space and the system memory space.

[0156] It is understandable that for the three-level page table, the basic verification phase mainly verifies the page table addresses and pointer addresses of the first-level page table, the second-level page table, and the third-level page table. Among them, the page table addresses of the first-level page table, the second-level page table, and the third-level page table must be within the address range of the third storage space, and the pointer addresses of the first-level page table and the second-level page table must be within the address range of the third storage space. The pointer address of the third-level page table can only point to the specified fourth storage space. By performing basic verification on the page table to be updated, the basic validity and correctness of the page table to be updated can be ensured.

[0157] As shown in FIG6 , in S101 , the second driver verifies the content of the page table to be updated written by the first driver in the first storage space to obtain the verification result, and the implementation may further include S1013 to S1014:

[0158] S1013. When the content of the page table to be updated includes the page table root to be updated, a full-link check is performed on the page table root to be updated through the second driver; wherein the full-link check is used to determine whether the pointing relationship of all page tables associated with the page table root to be updated is correct.

[0159] S1014 : When the page table root to be updated passes the address verification, the second driver determines that the verification result of the page table root to be updated is credible.

[0160] It should be noted that S1011 to S1012 and S1013 to S1014 are parallel solutions, that is, the server can execute S1011 to S1012 and can also execute S1013 to S1014.

[0161] In some embodiments of the present application, when the content of the page table to be updated includes the page table root to be updated (PCROOT), a full-link check is performed on all page tables associated with the page table root to be updated through the second driver.

[0162] In some embodiments of the present application, the page tables associated with the page table root to be updated include: a first page table, a second page table, and a third page table.

[0163] In some embodiments of the present application, the implementation of full-link verification according to the page table root to be updated by the second driver may include:

[0164] When the first page table pointed to by the page table root to be updated belongs to the first-level page table, the second page table pointed to by the page table entry in the first page table belongs to the second-level page table, the third page table pointed to by the page table entry in the second page table belongs to the third-level page table, and the address pointed to by the page table entry in the third page table belongs to the fourth storage space, the second driver determines that the page table root to be updated passes the full-link verification.

[0165] Exemplarily, FIG7 is a schematic diagram of an optional full-link verification provided by an embodiment of the present application. As shown in FIG7 , in the full-link verification stage, when the content of the page table to be updated is the page table root to be updated (shown as “page table root information” in FIG7 ), the second driver is used to verify whether there is an abnormality in the pointing addresses of all page tables associated with the page table root to be updated. If so, it indicates that the page table root to be updated is invalid. That is to say, taking the GPU three-level page table as an example, it is necessary to ensure that the first page table pointed to by the page table root to be updated belongs to the first-level page table PC, the second page table pointed to by the page table entry in the first page table belongs to the second-level page table PD, and the third page table pointed to by the page table entry in the second page table belongs to the third-level page table PT. At the same time, the page table addresses of the first-level page table, the second-level page table and the third-level page table must be within the address range of the third storage space, and the pointing addresses of the first-level page table and the second-level page table must be within the address range of the third storage space, and the pointing address of the third-level page table can only point to the specified fourth storage space range. Wherein, the fourth storage space includes the frame buffer space and the system memory space.

[0166] In the embodiment of the present application, the second driver performs a full-link check based on the currently maintained information table, that is, it checks all page tables associated with the page table root to be updated. If a problem is found in the pointing direction of a page table entry in a page table, it will be modified to be invalid. In this way, a reliable information table can be established through full-link check, ensuring the integrity and correctness of the page table.

[0167] In some embodiments of the present application, the address check further includes: supplementary check; when the content of the page table to be updated passes the basic check or the full link check, the method further includes:

[0168] In a case where the content of the to-be-updated page table includes the to-be-updated page table, the second driver performs a supplementary check on the to-be-updated page table; wherein the supplementary check is used to determine whether the pointing relationship of the to-be-updated page table is correct.

[0169] In some embodiments of the present application, the implementation of supplementary verification of the page table to be updated by the second driver may include: verifying the page address of the page table to be updated by the second driver according to the information table currently maintained by the second driver.

[0170] In the embodiment of the present application, the page table stored in the information table currently maintained by the second driver is a verified page table, that is, the page table in the information table currently maintained by the second driver is a known trusted page table. Therefore, the page address of the page table to be updated can be verified based on the known trusted page table in the information table, thereby determining whether the page table address of the page table to be updated is valid.

[0171] In some embodiments of the present application, for a GPU three-level page table, the page table to be updated belongs to any one of a first-level page table (PC), a second-level page table (PD), and a third-level page table (PT).

[0172] In some embodiments of the present application, verification of the page address of the page table to be updated by the second driver according to the page table address in the information table currently maintained by the second driver may include:

[0173] If the page table to be updated belongs to the first-level page table, then when the page table address of the page table to be updated is located in the page table address of any second-level page table and / or third-level page table in the information table, the second driver determines that the page table to be updated fails the supplementary check; or,

[0174] If the page table to be updated belongs to the second-level page table, then when the page table address of the page table to be updated is located at the page table address of any first-level page table and / or third-level page table in the information table, the second driver determines that the page table to be updated fails the supplementary check; or,

[0175] If the page table to be updated belongs to the third-level page table, then when the page table address of the page table to be updated is located at the page table address of any first-level page table and / or second-level page table in the information table, the second driver determines that the page table to be updated fails the supplementary check.

[0176] Exemplarily, FIG8 is a schematic diagram of an optional supplementary check provided in an embodiment of the present application. As shown in FIG8 , the page table to be updated is unknown, and the page table in the information table currently maintained by the second driver is known. In the case where the page table to be updated belongs to the third-level page table, if the page table address of the page table item of the page table to be updated is the page table address of any first-level page table and / or second-level page table in the information table, it indicates that the page table item in the page table to be updated is abnormal. Alternatively, in the case where the page table to be updated belongs to the second-level page table, if the page table address of the page table item of the page table to be updated is the page table address of any first-level page table and / or third-level page table in the information table, it indicates that the page table item in the page table to be updated is abnormal. Alternatively, in the case where the page table to be updated belongs to the first-level page table, if the page table address of the page table item of the page table to be updated is the page table address of any second-level page table and / or third-level page table in the information table, it indicates that the page table item in the page table to be updated is abnormal. At the same time, the page table addresses of the first-level, second-level, and third-level page tables must be within the address range of the third storage space. The addresses pointed to by the first-level and second-level page tables must be within the address range of the third storage space. The addresses pointed to by the third-level page table can only point to the specified fourth storage space. The fourth storage space includes the frame buffer space and system memory space.

[0177] It is understandable that, as shown in FIG8 , in the supplementary verification phase, when a page table entry in the page table to be updated needs to be updated, it is checked whether the page table address of the page table entry to be updated belongs to the page table address in the known information table. The update operation is performed according to the situation. If a page table entry of the page table to be updated belonging to the first-level page table PC is updated to a page table entry of a known second-level page table PD in the information table (indicated by the arrow pointing to "a" in Figure 8) or a page table entry of a third-level page table PT (indicated by the arrow pointing to "b" in Figure 8); or a page table entry of the page table to be updated belonging to the second-level page table PD is updated to a page table entry of a known first-level page table PC in the information table (indicated by the arrow pointing to "c" in Figure 8) or a page table entry of a third-level page table PT (indicated by the arrow pointing to "d" in Figure 8); or a page table entry of the page table to be updated belonging to the third-level page table PT is updated to a page table entry of a known first-level page table PC in the information table (indicated by the arrow pointing to "e" in Figure 8) or a page table entry of a second-level page table PD (indicated by the arrow pointing to "f" in Figure 8), the corresponding page table root information will become invalid. By performing supplementary verification on the page table to be updated, a reliable page table to be updated can be obtained, in which each page table entry has been fully verified. During the supplementary verification phase, if it is found that the page table address of the page table to be updated does not match the page table address of the known trusted page table, that is, there is an incorrect pointing relationship, the page table to be updated is marked as invalid, thereby ensuring the stability and security of the system.

[0178] In the embodiments of the present application, generally, the basic check is the first stage check, the full link check is the second stage check, and the supplementary check is the third stage check. It should be noted that the present application does not impose any restrictions on the execution order of the three stages, and the specific selection can be made according to the actual application scenario.

[0179] As you can understand, the three-stage verification mechanism described above ensures the generation of a trusted information table. Each page table entry contained in it undergoes rigorous verification, ensuring its correctness and security, thereby preventing malicious modifications or invalid page table entries from impacting the system. This verification mechanism ensures that the page tables updated by the GPU driver are trustworthy and valid, thereby ensuring system stability and security.

[0180] In some embodiments of the present application, the page table updating method further includes:

[0181] Apply for a second storage space through the second driver, and set the permission of the second storage space to the first driver as readable and writable through the second driver;

[0182] Apply for a third storage space through the second driver, and set the permission of the third storage space to the first driver to be neither readable nor writable through the second driver; wherein the page table content to be updated is the page table content that needs to be updated that the operating system requires the first driver to allocate to the third storage space.

[0183] In this embodiment, the server requests a second storage space (BAR1) through the second driver. The second storage space is exposed to the first driver as readable and writable. When the first driver writes data to the second storage space, a jump mechanism is immediately triggered. At this time, the vCPU executing the code in the first driver is suspended, and the vCPU executes the corresponding code in the second driver.

[0184] In this embodiment, the server applies for a third storage space (BAR4) through the second driver. The second driver reserves an independent MMU VRAM space (i.e., the third storage space) for the vGPU. The third storage space is exposed to the first driver as non-writable and non-readable, ensuring that the first driver cannot write to the page table on its own. By limiting the virtual machine's access to the page table, the second driver can better control and manage the virtual machine's memory operations while protecting the overall stability and security of the system.

[0185] In the embodiment of the present application, the third storage space may be one of BAR0 to BAR5 that are not used in the system. For example, the third storage space is BAR4 and the second storage space is BAR1.

[0186] In some embodiments of the present application, the page table updating method further includes:

[0187] The third storage space is reported to the operating system in the form of a memory segment through the first driver, so that the operating system entrusts the first driver to allocate the to-be-updated page table content to the third storage space.

[0188] In the embodiment of the present application, the first driver sets the third storage space as a separate memory segment and reports it to the operating system, so that the operating system only allocates the page table to BAR4.

[0189] In an embodiment of the present application, by setting the third storage space as a separate memory segment, it can be ensured that the operating system allocates the page table content to be updated to the memory area corresponding to the third storage space. In this way, the operating system can manage and access data related to the page table through this independent memory segment, which helps to improve the security and performance of the system and ensure the correctness and consistency of the page table data.

[0190] FIG9 is a second schematic diagram of an optional communication mechanism between a first driver and a second driver provided in an embodiment of the present application. As shown in FIG9 , a graphics processor 1 (GPU) is connected to a server, which runs a virtualization manager 2 (VMM). The server can run multiple virtual machines (VMs), such as a first virtual machine 31, a second virtual machine 32, and a third virtual machine 33. Each virtual machine can run an operating system. For example, the first virtual machine 31 can run a Windows operating system (shown as "first operating system" in FIG9 ), the second virtual machine 32 can run a Linux operating system (shown as "second operating system" in FIG9 ), and the third virtual machine 33 can run an Android operating system (shown as "third operating system" in FIG9 ). The server applies for a second storage space (BAR1) and a third storage space (BAR4) for the virtual graphics processor (vGPU) through a second driver (VMM driver) running on the virtualization manager. The second storage space has read and write permissions for the first driver running on the vGPU, while the third storage space has non-read and non-write permissions for the first driver running on the vGPU. The first driver sets the third storage space as a separate memory segment, and reports the third storage space to the operating system (VM) in the form of a memory segment, so that the operating system only allocates the page table to the third storage space.

[0191] An embodiment of the present application provides a page table update method, which is applied to a graphics processor, wherein the graphics processor runs a third driver. The method comprises: first, the graphics processor obtains a verification result through the third driver; then, based on the verification result, the graphics processor updates the information table currently maintained by the third driver to obtain a trusted information table. The second driver informs the third driver of the verification result of the page table content to be updated by issuing a task, so that the third driver can synchronously update the information table it maintains, so that the third driver and the second driver maintain the same trusted information table, ensuring the consistency of the trusted information table in the entire system, thereby effectively preventing the impact of malicious modifications to the page table content on the system, thereby ensuring the stability and security of the system.

[0192] FIG10 is a fifth flow chart of an optional page table updating method provided in an embodiment of the present application. As shown in FIG10 , the method includes S301 to S302:

[0193] S301. Obtain a verification result through a third driver; wherein the verification result is used to indicate whether the content of the page table to be updated is credible; the second driver notifies the third driver of the verification result by issuing a task.

[0194] In some embodiments of the present application, the implementation of obtaining the verification result by the third driver in S301 may include:

[0195] The verification result written by the second driver in the fifth storage space is obtained through the third driver; the fifth storage space is used to realize communication between the second driver and the third driver.

[0196] In the embodiment of the present application, the fifth storage space is a shared memory between the second driver and the third driver, and the fifth storage space is used to enable the second driver (VMM driver) to communicate with the third driver (scheduling chip driver).

[0197] In an embodiment of the present application, the server writes the verification result of the page table content to be updated into the fifth storage space through the second driver, so that the third driver can synchronously update the information table it maintains according to the verification result in the fifth storage space.

[0198] S302 : Based on the verification result, the third driver updates the information table currently maintained by the driver to obtain a trusted information table; the trusted information table is used to store relevant information of the trusted page table.

[0199] In some embodiments of the present application, the trusted information table includes at least: page table root information of the trusted page table.

[0200] In some embodiments of the present application, in S302, based on the verification result, the third driver updates the information table currently maintained by the third driver to obtain the trusted information table, which may include S3021 to S3022:

[0201] S3021. If the verification result indicates that the page table content to be updated is credible, add the page table root information corresponding to the page table content to be updated to the information table currently maintained by the third driver through the third driver, thereby obtaining a credible information table; or

[0202] S3022: When the verification result indicates that the page table content to be updated is untrustworthy, the third driver deletes the page table root information corresponding to the page table content to be updated in the information table currently maintained by the third driver, thereby obtaining a trustworthy information table.

[0203] In the embodiment of the present application, S3021 and S3022 are parallel schemes, that is, S3021 and S3022 can be executed one by one.

[0204] In an embodiment of the present application, the third driver maintains an information table. If the verification result indicates that the content of the page table to be updated is credible, the third driver adds the page table root information corresponding to the content of the page table to be updated to the currently maintained information table, thereby obtaining a credible information table; or, if the verification result indicates that the content of the page table to be updated is uncredible, the third driver deletes the page table root information corresponding to the content of the page table to be updated in the currently maintained information table, thereby obtaining a credible information table.

[0205] That is to say, the third driver adds or deletes the page table root information in the information table it currently maintains based on the inspection result of the page table content to be updated, so that the third driver maintains a reliable information table. Subsequent task processing based on this reliable information table can improve the security of the page table.

[0206] In some embodiments of the present application, the page table updating method further includes S303 to S304:

[0207] S303: Acquire, through the third driver, a task instruction written by the first driver in the sixth storage space; the sixth storage space is used to enable communication between the first driver and the third driver; the task instruction carries page table root information of the target page table;

[0208] S304 : When the page table root information of the target page table is the page table root information of any trusted page table in the trusted information table, execute task processing corresponding to the task instruction through the third driver.

[0209] In an embodiment of the present application, after the third driver and the second driver both maintain the same trusted information table, the first driver can issue tasks to the third driver, and the third driver performs corresponding task processing according to the trusted information table it maintains.

[0210] In the embodiment of the present application, the sixth storage space is a shared memory between the first driver and the third driver, and the sixth storage space is used to enable communication between the first driver and the third driver.

[0211] In an embodiment of the present application, when a task is issued to the GPU through the first driver, the third driver running on the GPU will verify the page table root information (PCROOT) of the target page table carried in the task instruction. If the third driver determines that the page table root information of the target page table is in the trusted information table it maintains, it means that the target page table is trusted, that is, the target page table is maintained and issued by the second driver and has passed the legitimacy verification. At this time, the third driver will receive the task instruction and submit it to the GPU, so that the GPU performs the corresponding task processing.

[0212] In the present application and embodiments, if the third driver determines that the page table root information of the target page table is not in the trusted information table it maintains, it indicates that the target page table may be illegal or unauthorized. In this case, the third driver will refuse to execute the task instruction to ensure the security and reliability of the system. In addition, after the task execution is refused, corresponding security measures may be taken, such as logging and issuing alarms, to further protect the system from potential security threats.

[0213] It can be understood that since the trusted page table in the trusted information table maintained by the third driver has been checked and verified by the second driver, the third driver determines whether to execute the task processing corresponding to the task instruction based on the trusted information table, which can effectively control the execution authority of the task and only allow tasks from the trusted page table to be executed, thereby improving the security and credibility of the system.

[0214] FIG11 is a schematic diagram of an optional communication mechanism of a first driver, a second driver, and a third driver provided in an embodiment of the present application. As shown in FIG11 , a virtual machine operating system 3 (VM) runs a first driver (VM driver), a virtualization manager 2 (VMM) runs a second driver (VMM driver), and a graphics processor 1 (GPU) includes multiple graphics processor core units (GPU Inner Units), for example, a first graphics processor core unit 111 and a second graphics processor core unit 112, and a third driver 113 (scheduling chip driver) runs on the graphics processor. The content of the page table to be updated is updated by the second driver. The content of the page table to be updated includes the page table to be updated and the page table root to be updated. When the members in the information table maintained by the second driver increase or decrease, the second driver will notify the third driver by issuing a task, so that the third driver also maintains an identical trusted information table internally. When the virtual machine operating system sends a task to the graphics processor through the first driver, the third driver running on the graphics processor will determine whether the page table root information of the target page table carried by the task instruction is a member of the trusted information table. If the page table root information of the target page table is a member of the trusted information table, it means that the target page table is trusted. If the page table root information of the target page table is trusted, the third driver will execute the task processing. If the page table root information of the target page table is untrusted, the third driver will reject the task instruction to protect the security of the system. Through the above mechanism and process, it can be ensured that the first driver's update of the page table is strictly controlled and verified, ensuring the security and credibility of the system.

[0215] FIG12 is a first schematic diagram of an optional interaction among a first driver, a second driver, and a third driver provided in an embodiment of the present application. As shown in FIG12 , the first driver and the second driver are run on the server, and the third driver is run on the graphics processor. The method may include S501 to S521:

[0216] S501: Initialize the graphics processor.

[0217] S502: Initialize the third driver.

[0218] S503: Create a second storage space.

[0219] S504: Create a third storage space.

[0220] S505: Prepare a virtual graphics processor device.

[0221] S506: Initialize the virtual graphics processor.

[0222] S507: Create a first storage space.

[0223] It should be noted that the execution subject of S501 to S505 is the second driver, and the execution subject of S506 to S507 is the first driver.

[0224] In the embodiment of the present application, regarding S501 to S507 above, during server startup, the second driver initializes the graphics processor, and the third driver is initialized by the second driver. Then, the second driver creates the second storage space (BAR1) and the third storage space (BAR4), and prepares the virtual graphics processor (vGPU) device by the second driver. Subsequently, the first driver initializes the virtual GPU, and the first driver creates the first storage space.

[0225] After the first driver receives the to-be-updated page table content sent by the operating system, if the to-be-updated page table content is a to-be-updated page table, S508 to S512 may be executed:

[0226] S508: Store the page table to be updated in the first storage space.

[0227] S509: Accessing the second storage space triggers a jump mechanism.

[0228] S510: Execute the first and third stage verifications.

[0229] S511: Update the information table currently maintained by the second driver.

[0230] S512: Update the information table currently maintained by the third driver.

[0231] It should be noted that the execution subject of S508 to S509 is the first driver, the execution subject of S510 to S511 is the second driver, and the execution subject of S512 is the third driver.

[0232] In an embodiment of the present application, for S508 to S512, in an embodiment of the present application, the page table to be updated is stored in the first storage space through the first driver, and when the number of page tables to be updated meets the preset number threshold, the first driver triggers the jump mechanism by accessing the second storage space. If the content of the page table to be updated is the page table to be updated, the page table to be updated can be verified in the first stage (basic verification) and the third stage (supplementary verification) by the second driver to obtain the verification result. Furthermore, the verification result of the content of the page table to be updated is notified to the third driver through the second driver, so that the third driver synchronizes the information table currently maintained according to the verification result, so that the second driver and the third driver can maintain the same trusted information table.

[0233] In the embodiment of the present application, checking the to-be-updated page table by the second driver may include the following two situations:

[0234] Case 1: When the page table root information (PCROOT) corresponding to the page table to be updated is not given, the second driver performs the first stage verification on the page table to be updated to obtain the verification result, and then the second driver updates its currently maintained information table according to the verification result.

[0235] Case 2: When the page table root information (PCROOT) corresponding to the page table to be updated is given and the page table root information passes the second stage (full link verification), the third stage verification is continued on the page table to be updated to obtain the verification result, and then the second driver updates its currently maintained information table according to the verification result.

[0236] If the page table to be updated is the page table root to be updated, then S513 to S517 may be executed:

[0237] S513: Store the page table root to be updated in the first storage space.

[0238] S514: Accessing the second storage space triggers a jump mechanism.

[0239] S515: Execute the second stage of verification.

[0240] S516: Update the information table currently maintained by the second driver.

[0241] S517: Update the information table currently maintained by the third driver.

[0242] It should be noted that the execution subject of S513 to S514 is the first driver, the execution subject of S515 to S516 is the second driver, and the execution subject of S517 is the third driver.

[0243] In the embodiment of the present application, for S513 to S517, the first driver stores the page table root to be updated in the first storage space. The first driver triggers the jump mechanism by accessing the second storage space. At this time, the second driver performs a second-stage verification on the page table root to be updated to obtain a verification result. Then, the second driver updates its currently maintained information table based on the verification result. Furthermore, the second driver notifies the third driver of the verification result of the page table content to be updated. In this way, the third driver synchronously updates its currently maintained information table based on the verification result, so that the second and third drivers can maintain the same trusted information table.

[0244] In the embodiment of the present application, after the third driver updates the currently maintained information table and obtains a trusted information table, S518 to S521 may be executed:

[0245] S518: Send task instructions.

[0246] S519: Check whether it is a trusted page table.

[0247] S520: Execute the task.

[0248] S521. Ignore the task.

[0249] It should be noted that the execution subject of S518 is the first driver, and the execution subject of S519 to S521 is the third driver.

[0250] It should be noted that, in S519, if it is a trusted page table, S520 is executed; if it is an untrusted page table, S521 is executed.

[0251] In an embodiment of the present application, for S518 to S521, the virtual machine operating system sends a task instruction to the graphics processor through the first driver, and the third driver running on the graphics processor verifies the target page table carried by the task instruction sent by the first driver. The third driver verifies whether the target page table is a trusted page table. If the third driver determines that the target page table is a trusted page table, the graphics processor executes the task corresponding to the task instruction. If the third driver determines that the target page table is an untrusted page table, the graphics processor ignores the task corresponding to the task instruction.

[0252] FIG13 is a second schematic diagram of an optional interaction between a first driver, a second driver, and a third driver provided in an embodiment of the present application. As shown in FIG13 , a server is connected to a graphics processor via a hardware interface. The first driver and the second driver are running on the server, and the third driver is running on the graphics processor. The page table update method includes steps S401 to S409:

[0253] S401: Apply for a second storage space and a third storage space through a second driver.

[0254] S402: Apply for a first storage space through a first driver.

[0255] S403: The page table content to be updated is written to the first storage space through the first driver. When the first driver determines that the page table content update condition is met, the first driver triggers a jump mechanism, and the task process of the first driver is suspended.

[0256] S404: When the jump mechanism is triggered by the first driver, the second driver performs at least one of basic verification, full-link verification, and supplementary verification on the content of the page table to be updated to obtain a verification result of the content of the page table to be updated.

[0257] S405 : Based on the verification result, the second driver updates the information table currently maintained by the second driver to obtain a credible information table.

[0258] S406 : Informing the third driver running on the graphics processor of the verification result through the second driver in a manner of issuing a task.

[0259] S407: Based on the verification result, the third driver synchronously updates the information table currently maintained by the third driver to obtain a reliable trusted information table.

[0260] S408 . Write the task instruction into the sixth storage space through the first driver, so that the third driver performs corresponding task processing according to the task instruction obtained in the sixth storage space; wherein the task instruction carries the page table root information of the target page table.

[0261] S409. Obtain the task instruction written by the first driver in the sixth storage space through the third driver. When the page table root information of the target page table is the page table root information of any trusted page table in the trusted information table, execute the task processing corresponding to the task instruction through the third driver.

[0262] Through the above mechanism and process, when the server triggers the jump mechanism through the first driver, the server verifies the page table to be updated through the second driver. In this way, it can be ensured that the first driver cannot update the page table by itself and can only entrust the second driver to update the page table. Compared with directly updating the page table through the first driver, it can ensure that the first driver's update of the page table is strictly controlled and verified, thereby ensuring the security and reliability of the system.

[0263] The following describes in detail the page table update method provided by the present application in conjunction with a specific embodiment. The page table update method provided in the embodiment of the present application requires the joint modification of the virtualization manager VMM driver (second driver), the VM client operating system driver (first driver), and the scheduling chip driver (third driver). The method includes the following steps:

[0264] Step 1: The GPU driver (equivalent to the second driver) in the VMM creates a dedicated MMU BAR for the vGPU. This is exposed to the VM as an additional independent BAR space for the vGPU device, named MMU BAR. This independent MMU BAR space is neither writable nor readable when exposed to the VM. This ensures that the VM does not have the ability to write to its own page table. For example, any unused BAR from BAR0 to BAR5 can be selected, which is visible in the VM as BAR4 (equivalent to the third storage space). The VM does not have read or write permissions for BAR4, meaning that neither reading nor writing will take effect.

[0265] Step 2: The GPU driver (equivalent to the second driver) in the VMM creates a virtualized BAR for the vGPU for VM-Exit purposes (equivalent to the jump mechanism). In the VM, it is visible as BAR1 (equivalent to the second storage space). The 64th byte of BAR1 is the MMU-specific byte for updating. When the VM writes, the vCPU will fall into the logic of executing the page table update in the VMM.

[0266] Specifically, the GPU driver in the VMM exposes a virtual barcode area (BAR), referred to as a vBAR, to the VM as readable and writable. When the VM writes data to this BAR, a VM-Exit is triggered, suspending the vCPU executing the code in the VM and returning to executing the corresponding VMM code.

[0267] Step 3: The driver in the VM (equivalent to the first driver) sets BAR4 (equivalent to the third storage space) as a separate segment (equivalent to a memory segment) and reports it to the VM operating system, and enables the operating system to allocate the page table only to BAR4.

[0268] Step 4. The driver in the VM (equivalent to the first driver) allocates a shared memory area A (equivalent to the first storage space), which stores the page table address and page table content that the VM operating system wants to update. When the storage reaches a certain amount (for example, 16 page table entries) or the operating system requires an update of PCROOT (that is, the page table content update condition is met), the VM driver will access the 64th byte of BAR1 (equivalent to the second storage space) and immediately trigger VM-Exit. At this time, the vCPU will jump to the VMM to execute the page table update logic.

[0269] That is to say, the driver in the VM (equivalent to the first driver) establishes a communication mechanism with the VMM (second driver), including but not limited to shared memory, socket, etc. Exemplarily, the driver in the VM allocates a shared memory area A (equivalent to the first storage space) for the VM driver to communicate with the VMM driver, mainly storing the page table data that the VM operating system wants to update, which is organized in a structure containing the page table address and page table content. All page table entries that the operating system entrusts the VM driver to update are cached and stored in shared memory A. When a certain amount is reached or the operating system requires an update of PCROOT, the VM driver will access the specified location in vBAR and trigger VM-Exit. At this time, the vCPU will jump to the logic of executing the page table update in the VMM.

[0270] Step 5: The page table update logic of the GPU driver (equivalent to the second driver) in the VMM reads the page table to be updated (equivalent to the content of the page table to be updated) in the shared memory area A, verifies it, and then writes it. The verification is divided into three stages:

[0271] Phase 1: The first phase (equivalent to basic verification) is to verify only the page table addresses and pointed addresses of PC (equivalent to the first-level page table), PD (equivalent to the second-level page table), and PT (equivalent to the third-level page table) before PCROOT is given. The PC, PD, and PT page table addresses must be located in the address range of BAR4 (the third storage space). The addresses pointed to by PC and PD can only be within the BAR4 range, and the address pointed to by PT can only point to the specified (usually Frame Buffer and system memory in GPU design) address (equivalent to the fourth storage space).

[0272] Phase 2: The second phase is a complete link verification (equivalent to a full link verification). This phase is triggered when the operating system requires an update of the PCROOT. The driver in the VMM will perform a full link verification based on the given PCROOT, that is, all page tables associated with the PCROOT will be verified. If a problem is found in the pointing of a page table entry, it will be modified to be invalid. The second phase verification can ensure the establishment of a trusted PCROOT.

[0273] Phase 3: The third phase is supplementary verification. When the table entry is updated, it will check whether the PC, PD, and PT that need to be updated belong to the addresses of PC, PD, and PT in the known trusted PCROOT table (equivalent to the information table). It will be updated according to the situation. If the PC is updated to the addresses of PD, PT, etc. in the known PCROOT, the PD is updated to the addresses of PC and PT, or the PT is updated to the addresses of PC and PD, the PCROOT will be invalid. This three-stage verification mechanism ensures that a trusted PCROOT table is obtained, and each item in the page table inside the PCROOT table is fully verified.

[0274] Step 6: When the number of members in the trusted PCROOT table in the VMM driver increases or decreases, the scheduling chip driver will be informed by issuing tasks, so that it also maintains an identical trusted PCROOT table internally.

[0275] Step 7: When the VM operating system sends a task to the GPU, the scheduling chip driver (equivalent to the third driver) will determine whether the PCROOT it carries is a member of the trusted PCROOT; if it is trusted, the task will be executed; if it is not trusted, the task will be refused.

[0276] Step 8. By establishing a unique channel for VM page table updates, the VM cannot update its own page table and must delegate this to the VMM. Furthermore, a three-stage verification mechanism ensures the maintenance of a trusted PCROOT table (equivalent to a trusted information table). The scheduler (equivalent to a third driver) determines whether to execute tasks issued by the operating system based on this PCROOT. This mechanism implements an efficient page table update verification mechanism, ensuring that a VM cannot access the data of other VMs through the GPU.

[0277] The page table update method provided in the embodiment of the present application can solve the security issues caused by the lack of a two-stage MMU in the GPU. Compared with the conventional implementation without GPU page table protection, the present application has the advantages of being fast and efficient, user-imperceptible, and without obvious baseline loss while ensuring security.

[0278] The above describes the implementation mode of the present application in detail with reference to the accompanying drawings. However, the present application is not limited to the specific details in the above implementation mode. Within the technical concept of the present application, the technical solution of the present application can be subjected to various simple modifications, and these simple modifications all fall within the scope of protection of the present application. For example, the various specific technical features described in the above specific implementation modes can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present application will not further describe the various possible combinations. For another example, the various different implementation modes of the present application can also be arbitrarily combined, as long as they do not violate the idea of ​​the present application, they should also be regarded as the contents disclosed in the present application. For another example, under the premise of no conflict, the various embodiments and / or the technical features in each embodiment described in the present application can be arbitrarily combined with the prior art, and the technical solution obtained after the combination should also fall within the scope of protection of the present application.

[0279] It should be understood that in the various method embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0280] Based on the same inventive concept as the above embodiment, FIG14 is a structural diagram of an optional server provided in an embodiment of the present application. As shown in FIG14 , the server 10 includes: a first drive part 11 and a second drive part 12; wherein,

[0281] The first driver part 11 is configured to verify the content of the page table to be updated written by the first driver in the first storage space through the second driver when the jump mechanism is triggered by the first driver, and obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible;

[0282] The second driver part 12 is configured to update the information table currently maintained by the second driver according to the verification result to obtain a trusted information table; the trusted information table is used to store relevant information of the trusted page table.

[0283] In some embodiments of the present application, when the jump mechanism is triggered by the first driver, the task process of the first driver is in a suspended state; wherein the task process is related to updating the page table content.

[0284] In some embodiments of the present application, the first driver part 11 is further configured to write the page table content to be updated to the first storage space through the first driver; the first storage space is used for the first driver and the second driver to communicate; when the first driver determines that the page table content update condition is met, the jump mechanism is triggered through the first driver.

[0285] In some embodiments of the present application, the page table content to be updated includes: a page table to be updated and / or a page table root to be updated, and the first driver part 11 is also configured to determine through the first driver that the page table content update condition is met when the number of the page tables to be updated in the first storage space meets a preset number threshold, and / or when the page table root to be updated exists in the first storage space.

[0286] In some embodiments of the present application, the first driver part 11 is further configured to access the second storage space through the first driver to trigger the jump mechanism; the first driver has read and write permissions for the second storage space.

[0287] In some embodiments of the present application, the first driver part 11 is further configured to read data of specific bytes in the second storage space through the first driver, and / or write data to specific bytes in the second storage space through the first driver to trigger the jump mechanism.

[0288] In some embodiments of the present application, the first driver part 11 is further configured to perform an address check on the page table to be updated through the second driver when the content of the page table to be updated includes the page table to be updated; wherein the address check is used to determine whether the page table address and the pointed address of the page table to be updated are credible; when the page table to be updated passes the address check, the second driver determines that the check result of the page table to be updated is credible.

[0289] In some embodiments of the present application, the first driver part 11 is further configured to perform a basic check on the page table to be updated through the second driver; wherein the basic check is used to determine whether the page address and the pointing address of the page table to be updated are within an allowed range.

[0290] In some embodiments of the present application, the page table to be updated belongs to any one of the first-level page table, the second-level page table and the third-level page table; wherein, the page table entry in the first-level page table points to the second-level page table, the page table entry in the second-level page table points to the third-level page table, and the page table entry in the third-level page table points to the physical memory space used to store real data.

[0291] In some embodiments of the present application, the second driver part 12 is further configured to, if the page table to be updated belongs to the first-level page table or the second-level page table, then when the page address and the pointing address of the page table to be updated are within the address range of the third storage space, determine through the second driver that the page table to be updated passes the basic check; wherein, the third storage space is a storage space for storing page tables applied for by the second driver; or, if the page table to be updated belongs to the third-level page table, then when the page address of the page table to be updated is within the address range of the third storage space, and the pointing address of the page table to be updated is within the address range of the fourth storage space, determine through the second driver that the page table to be updated passes the basic check; wherein, the fourth storage space is a physical memory space for storing real data.

[0292] In some embodiments of the present application, the fourth storage space includes a frame buffer space and / or a system memory space.

[0293] In some embodiments of the present application, the first driver part 11 is also configured to perform a full-link check on the page table root to be updated through the second driver when the content of the page table to be updated includes the page table root to be updated; wherein the full-link check is used to determine whether the pointing relationship of all page tables associated with the page table root to be updated is correct; when the page table root to be updated passes the address check, the second driver determines that the check result of the page table root to be updated is credible.

[0294] In some embodiments of the present application, the page tables associated with the page table root to be updated include: a first page table, a second page table and a third page table; the first driver part 11 is also configured to determine through the second driver that the page table root to be updated passes the full-link verification when the first page table pointed to by the page table root to be updated belongs to the first-level page table, the second page table pointed to by the page table entry in the first page table belongs to the second-level page table, the third page table pointed to by the page table entry in the second page table belongs to the third-level page table, and the address pointed to by the page table entry in the third page table belongs to the fourth storage space.

[0295] In some embodiments of the present application, the address check also includes: supplementary check; when the content of the page table to be updated passes the basic check or the full-link check, the first driver part 11 is also configured to perform a supplementary check on the page table to be updated through the second driver when the content of the page table to be updated includes the page table to be updated; wherein, the supplementary check is used to determine whether the pointing relationship of the page table to be updated is correct.

[0296] In some embodiments of the present application, the first driver part 11 is further configured to verify the page address of the to-be-updated page table through the second driver according to the information table currently maintained by the second driver.

[0297] In some embodiments of the present application, the page table to be updated belongs to any one of the first-level page table, the second-level page table and the third-level page table; the first driving part 11 is also configured to, if the page table to be updated belongs to the first-level page table, then when the page table address of the page table to be updated is located at the page table address of any second-level page table and / or third-level page table in the information table, determine through the second driving that the page table to be updated has not passed the supplementary check; or, if the page table to be updated belongs to the second-level page table, then when the page table address of the page table to be updated is located at the page table address of any first-level page table and / or third-level page table in the information table, determine through the second driving that the page table to be updated has not passed the supplementary check; or, if the page table to be updated belongs to the third-level page table, then when the page table address of the page table to be updated is located at the page table address of any first-level page table and / or second-level page table in the information table, determine through the second driving that the page table to be updated has not passed the supplementary check.

[0298] In some embodiments of the present application, the first driver part 11 is further configured to apply for a second storage space through the second driver, and set the permission of the second storage space to the first driver as readable and writable through the second driver; apply for a third storage space through the second driver, and set the permission of the third storage space to the first driver as unreadable and unwritable through the second driver, so that the first driver writes the page table content to be updated to the first storage space; wherein, the page table content to be updated is the page table content that needs to be updated that the operating system requires the first driver to allocate to the third storage space.

[0299] In some embodiments of the present application, the second driver part 12 is further configured to apply for the first storage space through the first driver; the first storage space is used for the first driver and the second driver to communicate.

[0300] In some embodiments of the present application, the trusted information table includes at least: page table root information of a trusted page table; the second driver part 12 is also configured to add the page table root information corresponding to the page table content to be updated to the information table currently maintained by the second driver through the second driver when the verification result indicates that the page table content to be updated is trusted, thereby obtaining the trusted information table; or, when the verification result indicates that the page table content to be updated is untrustworthy, delete the page table root information corresponding to the page table content to be updated in the information table currently maintained by the second driver, thereby obtaining the trusted information table.

[0301] In some embodiments of the present application, the second driver part 12 is further configured to inform the third driver running on the graphics processor of the verification result through the second driver in a manner of issuing tasks, so that the third driver synchronously updates the information table currently maintained by it according to the verification result, so that the third driver obtains the trusted information table.

[0302] In some embodiments of the present application, the second driver part 12 is further configured to write the verification result into a fifth storage space through the second driver, so that the third driver obtains the verification result through the fifth storage space; wherein, the fifth storage space is used to enable the second driver to communicate with the third driver.

[0303] In some embodiments of the present application, the second driver part 12 is further configured to write the task instruction into the sixth storage space through the first driver, so that the third driver performs corresponding task processing according to the task instruction obtained in the sixth storage space; wherein, the task instruction carries the page table root information of the target page table; the sixth storage space is used to enable the first driver to communicate with the third driver.

[0304] In some embodiments of the present application, the second driver part 12 is further configured to report the third storage space in the form of a memory segment to the operating system through the first driver, so that the operating system entrusts the first driver to allocate the page table content to be updated to the third storage space.

[0305] In some embodiments of the present application, based on the verification result, the second driver updates the information table currently maintained by the second driver. After obtaining a reliable information table, the task process of the first driver is in a running state.

[0306] Those skilled in the art should understand that the relevant description of the above-mentioned server in the embodiment of the present application can be understood with reference to the relevant description of the page table updating method in the embodiment of the present application.

[0307] Based on the same inventive concept as the above embodiments, FIG15 is a structural diagram of an optional graphics processor provided in an embodiment of the present application. As shown in FIG15 , the graphics processor 20 includes a third driving part 21; wherein,

[0308] The third driver part 21 is configured to obtain a verification result through the third driver; wherein, the verification result is used to indicate whether the content of the page table to be updated is credible; the verification result is notified to the third driver by the second driver in the form of issuing a task; according to the verification result, the information table currently maintained by the third driver is updated to obtain a credible information table; the credible information table is used to store relevant information of the credible page table.

[0309] In some embodiments of the present application, the third driver part 21 is further configured to obtain the verification result written by the second driver in the fifth storage space through the third driver; the fifth storage space is used to enable the second driver to communicate with the third driver.

[0310] In some embodiments of the present application, the trusted information table includes at least: page table root information of a trusted page table; the third driver part 21 is also configured to add the page table root information corresponding to the page table content to be updated to the information table currently maintained by the third driver through the third driver when the verification result indicates that the page table content to be updated is trusted, thereby obtaining the trusted information table; or, when the verification result indicates that the page table content to be updated is untrustworthy, delete the page table root information corresponding to the page table content to be updated in the information table currently maintained by the third driver, thereby obtaining the trusted information table.

[0311] In some embodiments of the present application, the third driver part 21 is further configured to obtain the task instruction written by the first driver in the sixth storage space through the third driver; the sixth storage space is used to enable the first driver to communicate with the third driver; the task instruction carries the page table root information of the target page table; when the page table root information of the target page table is the page table root information of any trusted page table in the trusted information table, the task processing corresponding to the task instruction is executed through the third driver.

[0312] Those skilled in the art should understand that the description of the graphics processor in the embodiment of the present application can be understood with reference to the description of the page table updating method in the embodiment of the present application.

[0313] FIG16 is a second structural diagram of an optional server provided in an embodiment of the present application. As shown in FIG16 , the server 10 includes a first memory 13 and a first processor 14, wherein:

[0314] The first memory 13 is used to store executable instructions; the first processor 14 is used to implement the above-mentioned method for updating the page table on the server side when executing the executable instructions stored in the first memory.

[0315] FIG17 is a second schematic diagram of the structure of an optional graphics processor provided in an embodiment of the present application. As shown in FIG17 , the graphics processor 20 includes a second memory 22 and a second processor 23, wherein the second memory 22 is used to store executable instructions; and the second processor 23 is used to implement the above-described method for updating the page table on the graphics processor side when executing the executable instructions stored in the second memory.

[0316] Figure 18 is a schematic structural diagram of an optional chip provided in an embodiment of the present application. As shown in Figure 18, the chip 40 includes a processor 41. The processor 41 can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0317] In some embodiments of the present application, as shown in FIG18 , the chip 40 may further include a memory 42. The processor 41 may call and execute a computer program from the memory 42 to implement the methods described in the embodiments of the present application. The memory 42 may be a separate device independent of the processor 41 or integrated within the processor 41. The processor 41 may include a first processor 14 and a second processor 23. In some embodiments of the present application, the chip 40 may further include an input interface 43. The processor 41 may control the input interface 43 to communicate with other devices or chips, specifically, to obtain information or data sent by other devices or chips. In some embodiments of the present application, the chip 40 may further include an output interface 44. The processor 41 may control the output interface 44 to communicate with other devices or chips, specifically, to output information or data to other devices or chips. In some embodiments of the present application, the chip may be used in the server described in the embodiments of the present application; for the sake of brevity, this description will not be repeated here. In some embodiments of the present application, the chip may be used in the graphics processor described in the embodiments of the present application; for the sake of brevity, this description will not be repeated here.

[0318] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0319] FIG19 is a schematic block diagram of an optional communication system provided in an embodiment of the present application. As shown in FIG19 , the communication system 50 includes a server 51 and a graphics processor 52. The server 51 can be used to implement the corresponding functions implemented by the server in the above-mentioned method, and the graphics processor 52 can be used to implement the corresponding functions implemented by the graphics processor in the above-mentioned method. For the sake of brevity, these are not described here. The server 51 can be the server 10 described above, and the graphics processor 52 can be the graphics processor 20 described above.

[0320] It is understood that the processor of the embodiments of the present application may be an integrated circuit chip with information processing capabilities. During implementation, each step of the above method embodiment can be completed by hardware integrated logic circuits in the processor or software instructions. The above processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented as a hardware decoding processor, or can be implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0321] It is also understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0322] It is also understood that the above-mentioned memories are exemplary but not restrictive. For example, the memories in the embodiments of the present application may also be static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM RAM (DR RAM). In other words, the memories in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0323] The present application also provides a computer-readable storage medium for storing a computer program. In some embodiments of the present application, the computer-readable storage medium may be applied to a server in the embodiments of the present application, and when the computer program is executed by at least one processor, it implements the corresponding processes implemented by the server in the various methods of the present application. For the sake of brevity, no further details are given here. In some embodiments of the present application, the computer-readable storage medium may be applied to a graphics processor in the embodiments of the present application, and when the computer program is executed by at least one processor, it implements the corresponding processes implemented by the graphics processor in the various methods of the present application. For the sake of brevity, no further details are given here. The present application also provides a computer program product, including computer program instructions. In some embodiments of the present application, the computer program product may be applied to a server in the embodiments of the present application, and the computer program instructions cause a computer to execute the corresponding processes implemented by the server in the various methods of the present application. For the sake of brevity, no further details are given here. In some embodiments of the present application, the computer program product may be applied to a graphics processor in the embodiments of the present application, and the computer program instructions cause a computer to execute the corresponding processes implemented by the graphics processor in the various methods of the present application. For the sake of brevity, no further details are given here.

[0324] The embodiment of the present application also provides a computer program.

[0325] In some embodiments of the present application, the computer program may be applied to the server in the embodiments of the present application. When the computer program is executed on a computer, the computer executes the corresponding processes implemented by the server in the various methods of the embodiments of the present application. For the sake of brevity, this description is not repeated here. In some embodiments of the present application, the computer program may be applied to the graphics processor in the embodiments of the present application. When the computer program is executed on a computer, the computer executes the corresponding processes implemented by the graphics processor in the various methods of the embodiments of the present application. For the sake of brevity, this description is not repeated here.

[0326] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0327] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0328] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0329] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, the functional units in the various embodiments of the present application may be integrated into a processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. If the functions are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or the part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., which can store program codes.

[0330] It should be noted that, in this application, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0331] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0332] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments. The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments. The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments. The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered within the scope of protection of this application. Industrial Applicability

[0333] The embodiments of the present application disclose a page table update method, server, graphics processor, chip, and storage medium. The method is applied to a server, and the server runs a first driver and a second driver; wherein the method includes: when a jump mechanism is triggered by the first driver, the second driver verifies the contents of the page table to be updated written by the first driver in the first storage space to obtain a verification result; the verification result is used to indicate whether the page table to be updated is credible; based on the verification result, the second driver updates the information table currently maintained by the second driver to obtain a credible information table; the credible information table is used to store relevant information of the credible page table. The present application can improve the security of updating the page table.

Claims

1. A method for updating a page table, applied to a server, wherein the server runs a first driver and a second driver, the method comprising: In the case where the jump mechanism is triggered by the first driver, the content of the to-be-updated page table written by the first driver in the first storage space is verified by the second driver to obtain a verification result; The verification result is used to indicate whether the page table to be updated is credible; According to the verification result, the second driver updates the information table currently maintained by the second driver to obtain a reliable information table; The trusted information table is used to store the related information of the trusted page table.

2. The method according to claim 1, wherein: When the jump mechanism is triggered by the first driver, the task process of the first driver is in a suspended state; wherein the task process is related to updating the content of the page table.

3. The method according to claim 1, wherein: Before verifying the to-be-updated page table content written by the first driver in the first storage space by the second driver and obtaining the verification result, the method further includes: Writing the to-be-updated page table content into the first storage space through the first driver; the first storage space is used for the first driver and the second driver to communicate; When it is determined through the first driver that the page table content update condition is met, the jump mechanism is triggered through the first driver.

4. The method according to claim 3, wherein: The content of the page table to be updated includes: the page table to be updated and / or the page table root to be updated, and the method further includes: When the number of the to-be-updated page tables in the first storage space meets a preset number threshold, and / or when the to-be-updated page table root exists in the first storage space, the first driver determines that the page table content update condition is met.

5. The method according to claim 3, wherein: The triggering of the jump mechanism by the first drive includes: The jump mechanism is triggered by accessing the second storage space through the first driver; the first driver has read and write permissions for the second storage space.

6. The method according to claim 5, wherein: The accessing the second storage space through the first driver to trigger the jump mechanism includes: The jump mechanism is triggered by reading data of a specific byte in the second storage space through the first driver, and / or writing data to a specific byte in the second storage space through the first driver.

7. The method according to claim 1, wherein: The verifying, by the second driver, the to-be-updated page table content written by the first driver in the first storage space to obtain a verification result includes: In the case where the content of the page table to be updated includes the page table to be updated, performing an address check on the page table to be updated through the second driver; wherein the address check is used to determine whether the page table address and the pointing address of the page table to be updated are credible; In a case where the page table to be updated passes the address check, the second driver determines that the check result of the page table to be updated is credible.

8. The method according to claim 7, wherein: The address check includes: basic check; the address check of the to-be-updated page table by the second driver includes: The page table to be updated is basically checked by the second driver, wherein the basic check is used to determine whether the page address and the pointing address of the page table to be updated are within an allowed range.

9. The method according to claim 8, wherein: The page table to be updated belongs to any one of a first-level page table, a second-level page table and a third-level page table; wherein the page table entries in the first-level page table point to the second-level page table, the page table entries in the second-level page table point to the third-level page table, and the page table entries in the third-level page table point to a physical memory space for storing real data; The performing basic verification on the to-be-updated page table by the second driver includes: If the page table to be updated belongs to the first-level page table or the second-level page table, then when the page address and the pointing address of the page table to be updated are located within the address range of the third storage space, the second driver determines that the page table to be updated passes the basic check; wherein the third storage space is a storage space for storing page tables applied for by the second driver; or, If the page table to be updated belongs to the third-level page table, then when the page address of the page table to be updated is within the address range of the third storage space, and the address pointed to by the page table to be updated is within the address range of the fourth storage space, the second driver determines that the page table to be updated passes the basic check; wherein, the fourth storage space is a physical memory space for storing real data.

10. The method according to claim 9, wherein: The fourth storage space includes a frame buffer space and / or a system memory space.

11. The method according to claim 1, wherein: The verifying, by the second driver, the to-be-updated page table content written by the first driver in the first storage space to obtain a verification result includes: In the case where the content of the page table to be updated includes a page table root to be updated, a full-link check is performed on the page table root to be updated through the second driver; wherein the full-link check is used to determine whether the pointing relationship of all page tables associated with the page table root to be updated is correct; When the page table root to be updated passes the full-link verification, the second driver determines that the verification result of the page table root to be updated is credible.

12. The method according to claim 11, wherein: The page tables associated with the page table root to be updated include: a first page table, a second page table and a third page table; The performing a full-link check on the page table root to be updated by the second driver includes: When the first page table pointed to by the page table root to be updated belongs to the first-level page table, the second page table pointed to by the page table entry in the first page table belongs to the second-level page table, the third page table pointed to by the page table entry in the second page table belongs to the third-level page table, and the address pointed to by the page table entry in the third page table belongs to the fourth storage space, the second driver determines that the page table root to be updated passes the full-link check.

13. The method according to any one of claims 7 to 12, wherein: The address check further includes: supplementary check; when the content of the page table to be updated passes the basic check or the full link check, the method further includes: In the case that the content of the page table to be updated includes the page table to be updated, the second driver performs a supplementary check on the page table to be updated; wherein the supplementary check is used to determine whether the pointing relationship of the page table to be updated is correct.

14. The method according to claim 13, wherein: The performing supplementary check on the to-be-updated page table by the second driver includes: According to the information table currently maintained by the second driver, the page address of the to-be-updated page table is verified by the second driver.

15. The method according to claim 14, wherein: The page table to be updated belongs to any one of a first-level page table, a second-level page table, and a third-level page table; The verifying, by the second driver, the page address of the to-be-updated page table according to the information table currently maintained by the second driver comprises: If the page table to be updated belongs to the first-level page table, then when the page table address of the page table to be updated is located at the page table address of any second-level page table and / or third-level page table in the information table, it is determined by the second driver that the page table to be updated does not pass the supplementary check; or, If the page table to be updated belongs to the second-level page table, then when the page table address of the page table to be updated is located at the page table address of any first-level page table and / or third-level page table in the information table, it is determined by the second driver that the page table to be updated does not pass the supplementary check; or, If the page table to be updated belongs to the third-level page table, then when the page table address of the page table to be updated is located at the page table address of any first-level page table and / or second-level page table in the information table, the second driver determines that the page table to be updated does not pass the supplementary check.

16. The method according to any one of claims 1 to 6, wherein: The method further comprises: Applying for a second storage space through the second driver, and setting the permission of the second storage space to the first driver as readable and writable through the second driver; Apply for a third storage space through the second driver, and set the permission of the third storage space for the first driver to be unreadable and unwritable through the second driver, so that the first driver writes the page table content to be updated to the first storage space; wherein the page table content to be updated is the page table content that needs to be updated that the operating system requires the first driver to allocate to the third storage space.

17. The method according to any one of claims 1 to 6, wherein: The method further comprises: The first storage space is applied for through the first driver; the first storage space is used for the first driver and the second driver to communicate with each other.

18. The method according to any one of claims 1 to 6, wherein: The trusted information table at least includes: page table root information of the trusted page table; The updating of the information table currently maintained by the second driver according to the verification result to obtain a reliable information table includes: When the verification result indicates that the page table content to be updated is credible, the page table root information corresponding to the page table content to be updated is added to the information table currently maintained by the second driver through the second driver, thereby obtaining the credible information table; or When the verification result indicates that the to-be-updated page table content is untrustworthy, the second driver deletes the page table root information corresponding to the to-be-updated page table content in the information table currently maintained by the second driver, thereby obtaining the credible information table.

19. The method according to any one of claims 1 to 6, wherein: After the second driver updates the information table currently maintained by the second driver according to the verification result to obtain a reliable information table, the method further includes: The verification result is notified to the third driver running on the graphics processor through the second driver in a task-issuing manner, so that the third driver synchronously updates the information table currently maintained by the third driver according to the verification result, so that the third driver obtains the credible information table.

20. The method according to claim 19, wherein: The step of informing a third driver running on a graphics processor of the verification result through the second driver in a manner of issuing a task includes: The verification result is written into a fifth storage space through the second driver, so that the third driver obtains the verification result through the fifth storage space; wherein the fifth storage space is used to enable the second driver to communicate with the third driver.

21. The method according to any one of claims 1 to 6, wherein: The method further comprises: The task instruction is written into the sixth storage space through the first driver, so that the third driver performs the corresponding task processing according to the task instruction obtained in the sixth storage space; wherein, The task instruction carries page table root information of the target page table; and the sixth storage space is used to enable the first driver to communicate with the third driver.

22. The method according to any one of claims 1 to 6, wherein: The method further comprises: The third storage space is reported to the operating system in the form of a memory segment through the first driver, so that the operating system requires the first driver to allocate the to-be-updated page table content to the third storage space.

23. The method according to any one of claims 1 to 6, wherein: According to the verification result, the second driver updates the information table currently maintained by the second driver. After obtaining a reliable information table, the task process of the first driver is in a running state.

24. A page table updating method, applied to a graphics processor, wherein the graphics processor runs a third driver, the method comprising: The verification result is obtained through the third driver; wherein the verification result is used to indicate whether the content of the page table to be updated is credible; the verification result is notified to the third driver by the second driver in the form of issuing a task; According to the verification result, the third driver updates the information table currently maintained to obtain a trusted information table; the trusted information table is used to store the related information of the trusted page table.

25. The method according to claim 24, wherein: The obtaining the verification result through the third driver includes: The verification result written by the second driver in the fifth storage space is obtained through the third driver; the fifth storage space is used to enable the second driver to communicate with the third driver.

26. The method according to claim 24, wherein: The trusted information table at least includes: page table root information of the trusted page table; The updating of the information table currently maintained by the third driver according to the verification result to obtain a reliable information table includes: When the verification result indicates that the page table content to be updated is credible, the page table root information corresponding to the page table content to be updated is added to the information table currently maintained by the third driver through the third driver, thereby obtaining the credible information table; or When the verification result indicates that the to-be-updated page table content is untrustworthy, the third driver deletes the page table root information corresponding to the to-be-updated page table content in the information table currently maintained by the third driver, thereby obtaining the credible information table.

27. The method according to any one of claims 24 to 26, wherein: The method further comprises: Acquire the task instruction written by the first driver in the sixth storage space through the third driver; the sixth storage space is used to realize the communication between the first driver and the third driver; the task instruction carries the page table root information of the target page table; In a case where the page table root information of the target page table is the page table root information of any trusted page table in the trusted information table, the task processing corresponding to the task instruction is executed by the third driver.

28. A server, comprising a first drive part and a second drive part; wherein: The first driver part is configured to verify the to-be-updated page table content written by the first driver in the first storage space through the second driver when the jump mechanism is triggered by the first driver, and obtain a verification result; The verification result is used to indicate whether the page table to be updated is credible; The second driver part is configured to update the information table currently maintained by the second driver according to the verification result to obtain a credible information table; The trusted information table is used to store the related information of the trusted page table.

29. A graphics processor, comprising a third driving part; wherein: The third driver part is configured to obtain a verification result through the third driver; wherein the verification result is used to indicate whether the content of the page table to be updated is credible; the verification result is notified to the third driver by the second driver in the form of issuing a task; according to the verification result, the information table currently maintained by the third driver is updated to obtain a credible information table; the credible information table is used to store relevant information of the credible page table.

30. A server, comprising: A first processor and a first memory, wherein the first memory is used to store a computer program, and the first processor is used to call and run the computer program stored in the first memory to execute the page table updating method according to any one of claims 1 to 23.

31. A graphics processor, comprising: A second processor and a second memory, the second memory is used to store a computer program, and the second processor is used to call and run the computer program stored in the second memory to execute the page table updating method as described in any one of claims 24 to 27.

32. A chip, comprising: A processor, used to call and run a computer program from a memory, so that a device equipped with the chip executes a page table update method as described in any one of claims 1 to 23; or, executes a page table update method as described in any one of claims 24 to 27.

33. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by at least one processor, implements the page table updating method as described in any one of claims 1 to 23; or, implements the page table updating method as described in any one of claims 24 to 27.

Images