Techniques for metadata processing
A method of and system for performing metadata tag compression in security policy enforcement system may comprise conveying a set of data elements, each with an associated metadata tag, from a first processor subsystem to a second processor subsystem. The first processor subsystem may be configured to process conventional tasks, the second processor configured to apply one or more policy decisions to the data element. The conveying may further comprise sending the set of data elements along with an index element that identifies one or more metadata tags, and sending one or more of the metadata tags identified by the index element.
1. A method comprising:
at an input/output (IO) metadata processor having a cache configured to store one or more rules, receiving, from a first fabric, a direct memory access (DMA) request directed to an address of a second fabric;
generating an unvalidated request to obtain DMA data, the unvalidated request (i) being based on the DMA request and at least one of the one or more rules triggered by the DMA request, and (ii) being generated prior to a validation, by the IO metadata processor, of the DMA request;
obtaining DMA data that was requested by the unvalidated request, the DMA data located at the address of the second fabric and obtaining tags associated with the DMA data;
attempting to load at least one of the one or more rules from the cache of the IO metadata processor based on the tags obtained, wherein the at least one rule based on the tags obtained indicates a set of addresses;
when the at least one rule based on the tags obtained is not found in the cache, executing rule miss handling; and
when the at least one rule based on the tags obtained is found in the cache, allowing the DMA request.
2. The method of claim 1 , wherein the first fabric is an untrusted fabric, and the second fabric is a trusted fabric.
3. The method of claim 2 , further comprising:
when the DMA request is allowed, allowing reading of the address of the trusted fabric; and
when the DMA request is allowed and the DMA request is a write request, allowing write back to the address of the trusted fabric.
4. The method of claim 3 , wherein allowing reading of the address and allowing write back is performed over an output channel between the IO metadata processor and the untrusted fabric.
5. The method of claim 2 , further comprising storing device state information in an untrusted fabric device register file.
6. The method of claim 2 wherein obtaining the DMA data is over an initial channel from the trusted fabric to the IO metadata processor, the channel being isolated from the untrusted fabric.
7. The method of claim 2 , wherein the untrusted fabric is at least one of a network device, ethernet DMA device, universal asynchronous receiver/transmitter (UART), and serial communication device.
8. The method of claim 2 , wherein executing rule cache miss handling includes at least one of (i) rejecting the DMA request and (ii) redirecting the DMA request to an address separate from the trusted fabric.
9. The method of claim 1 , wherein executing rule cache miss handling includes sending, from the IO metadata processor, an interrupt to a processor connected with the IO metadata processor.
10. The method of claim 2 , wherein the DMA data includes at least one of an operation group, a tag identifying a state of the untrusted fabric, a tag identifying the untrusted fabric, a tag indicating a trust level of the untrusted fabric, a memory input tag, an enable byte tag, a memory result tac, and tag of a state of the untrusted fabric state after the DMA request is processed.
11. A system comprising:
an input/output (IO) cache; and
an input/output (IO) metadata processor coupled to a memory with computer code instructions stored thereon, the IO metadata processor having a cache configured to store one or more rules, the computer code instructions, when executed by the IO metadata processor, cause the system to:
receive, from a first fabric, a direct memory access (DMA) request directed to an address of a second fabric;
generate an unvalidated request to obtain DMA data, the unvalidated request (i) being based on the DMA request and at least one of the one or more rules triggered by the DMA request, and (ii) being generated prior to a validation, by the IO metadata processor, of the DMA request;
obtain DMA data that was requested by the unvalidated request, the DMA data located at the address of the second fabric and obtain tags associated with the DMA data; and
attempt to load at least one of the one or more rules from the IO cache of the IO metadata processor based on the tags obtained, wherein the at least one rule based on the tags obtained indicates a set of addresses;
when the at least one rule based on the tags obtained is not found in the IO cache, execute rule miss handling;
when the at least one rule based on the tags obtained is found in the IO cache, allowing the DMA request.
12. The system of claim 11 , wherein the first fabric is an untrusted fabric, and the second fabric is a trusted fabric.
13. The system of claim 12 , wherein the IO metadata processor is further configured to:
when the DMA request is allowed, allow reading of the address of the trusted fabric; and
when the DMA request is allowed and the DMA request is a write request, allow write back to the address of the trusted fabric.
14. The system of claim 13 , wherein allowing reading of the address and allowing write back is performed over an output channel between the IO metadata processor and the untrusted fabric.
15. The system of claim 12 , wherein the IO metadata processor is further configured to store device state information in an untrusted fabric device register file.
16. The system of claim 12 wherein the IO metadata processor is configured to obtain the DMA data over an initial channel from the trusted fabric to the IO metadata processor, the channel being isolated from the untrusted fabric.
17. The system of claim 12 , wherein the untrusted fabric is at least one of a network device, ethernet DMA device, universal asynchronous receiver/transmitter (UART), and serial communication device.
18. The system of claim 12 , wherein execution of rule cache miss handling includes at least one of (i) rejection of the DMA request and (ii) redirection of the DMA request to an address separate from the trusted fabric.
19. The system of claim 12 , wherein execution of rule cache miss handling includes conveyance, from the IO metadata processor, of an interrupt to a processor connected with the IO metadata processor.
20. The system of claim 12 , wherein the DMA data includes at least one of an operation group, a tag identifying a state of the untrusted fabric, a tag identifying the untrusted fabric, a tag indicating a trust level of the untrusted fabric, a memory input tag, an enable byte tag, a memory result tac, and tag of a state of the untrusted fabric state after the DMA request is processed.