Virtual splitting of memories
A system includes a memory, including a plurality of memory locations having different respective addresses, and a processor. The processor is configured to compute one of the addresses from (i) a first sequence of bits derived from a tag of a data item, and (ii) a second sequence of bits representing a class of the data item. The processor is further configured to write the data item to the memory location having the computed address and/or read the data item from the memory location having the computed address. Other embodiments are also described.
1. A system, comprising:
a memory, comprising a plurality of memory locations having different respective addresses; and
a processor to:
compute one of the addresses from (i) a first sequence of bits derived from a tag of a data item, and (ii) a second sequence of bits representing a class of the data item, and
write the data item to the memory location having the computed address or read the data item from the memory location having the computed address,
the first sequence of bits having a number of possible values that is less than a number of the memory locations, such that the class of the data item cannot occupy all the memory locations at once despite not being allotted a fixed subset of the memory locations.
2. The system according to claim 1 , wherein the processor is further to compute the first sequence of bits by applying a function, which maps to any one of the possible values, to the tag.
3. The system according to claim 2 ,
wherein the function is a first function, and
wherein the processor is to compute the address by applying a second function, which maps to any one of the addresses, to a combination of the second sequence with the first sequence.
4. The system according to claim 3 , wherein the processor is to apply the second function to a concatenation of the second sequence with the first sequence.
5. The system according to claim 2 , further comprising another memory to store an association between multiple classes of data items and respective functions that include the function,
wherein at least two of the functions map to different respective numbers of possible outputs, and
wherein the processor is further to select the function in response to the function being associated, in the other memory, with the class of the data item.
6. The system according to claim 5 , wherein the function is a first function, and wherein the processor is further to associate with the class of the data item, in the other memory, a second function, which maps to a smaller number of possible outputs than does the first function, in response to identifying an attack on the memory.
7. The system according to claim 1 , wherein the data item includes one or more packet-processing instructions for packets belonging to any flow of network traffic whose flow identifier includes a specific value of at least one field, and wherein the second sequence represents the class of the data item by virtue of indicating the specific value.
8. The system according to claim 7 , wherein the at least one field includes a field selected from the group of fields consisting of: a layer-2 source address, a layer-3 source address, a layer-4 source address, a layer-2 destination address, a layer-3 destination address, and a layer-4 destination address.
9. The system according to claim 1 , wherein the data item includes one or more packet-processing instructions for packets received at a specific port, and wherein the second sequence represents the class of the data item by virtue of indicating the port.
10. The system according to claim 1 , wherein the second sequence represents the class of the data item by virtue of identifying a process, running on the processor, that writes the data item to the memory location having the computed address or reads the data item from the memory location having the computed address.
11. The system according to claim 1 , wherein the second sequence represents the class of the data item by virtue of identifying the processor.
12. The system according to claim 1 , wherein the second sequence represents the class of the data item by virtue of indicating a level of privilege required to overwrite the data item in the memory.
13. The system according to claim 2 ,
wherein the function is a first function, and
wherein the processor is to compute the address by:
computing a third sequence of bits by applying a second function to the second sequence of bits, and
combining the first sequence of bits with the third sequence of bits.
14. The system according to claim 13 ,
wherein the second function maps to 2 B different values, B being a difference, of at least one, between (i) a first smallest integer that is greater than or equal to a logarithm-to-a-base-of-two of the number of memory locations, and (ii) a second smallest integer that is greater than or equal to a logarithm-to-a-base-of-two of the number of possible values.
15. A method for use with a memory including a plurality of memory locations having different respective addresses, the method comprising:
using a processor, computing one of the addresses from (i) a first sequence of bits derived from a tag of a data item, and (ii) a second sequence of bits representing a class of the data item, and
writing the data item to the memory location having the computed address or reading the data item from the memory location having the computed address,
the first sequence of bits having a number of possible values that is less than a number of the memory locations, such that the class of the data item cannot occupy all the memory locations at once despite not being allotted a fixed subset of the memory locations.
16. The method according to claim 15 , further comprising computing the first sequence of bits by applying a function, which maps to any one of the possible values, to the tag.
17. The method according to claim 16 ,
wherein the function is a first function, and
wherein computing the address comprises computing the address by applying a second function, which maps to any one of the addresses, to a combination of the second sequence with the first sequence.
18. The method according to claim 17 , wherein applying the second function comprises applying the second function to a concatenation of the second sequence with the first sequence.
19. The method according to claim 16 ,
wherein another memory stores an association between multiple classes of data items and respective functions that include the function,
wherein at least two of the functions map to different respective numbers of possible outputs, and
wherein the method further comprises selecting the function in response to the function being associated, in the other memory, with the class of the data item.
20. The method according to claim 19 , wherein the function is a first function, and wherein the method further comprises associating with the class of the data item, in the other memory, another function, which maps to a smaller number of possible outputs than does the first function, in response to identifying an attack on the memory.
21. The method according to claim 15 , wherein the data item includes one or more packet-processing instructions for packets belonging to any flow of network traffic whose flow identifier includes a specific value of at least one field, and wherein the second sequence represents the class of the data item by virtue of indicating the specific value.
22. The method according to claim 21 , wherein the at least one field includes a field selected from the group of fields consisting of: a layer-2 source address, a layer-3 source address, a layer-4 source address, a layer-2 destination address, a layer-3 destination address, and a layer-4 destination address.
23. The method according to claim 15 , wherein the data item includes one or more packet-processing instructions for packets received at a specific port, and wherein the second sequence represents the class of the data item by virtue of indicating the port.
24. The method according to claim 15 , wherein the second sequence represents the class of the data item by virtue of identifying a process, running on the processor, that writes the data item to the memory location having the computed address or reads the data item from the memory location having the computed address.
25. The method according to claim 15 , wherein the second sequence represents the class of the data item by virtue of identifying the processor.
26. The method according to claim 15 , wherein the second sequence represents the class of the data item by virtue of indicating a level of privilege required to overwrite the data item in the memory.
27. The method according to claim 16 ,
wherein the function is a first function, and
wherein computing the address comprises computing the address by:
computing a third sequence of bits by applying a second function to the second sequence of bits, and
combining the first sequence of bits with the third sequence of bits.
28. The method according to claim 27 ,
wherein the second function maps to 2 B different values, B being a difference, of at least one, between (i) a first smallest integer that is greater than or equal to a logarithm-to-a-base-of-two of the number of memory locations, and (ii) a second smallest integer that is greater than or equal to a logarithm-to-a-base-of-two of the number of possible values.