GPU Virtual Function State Modification in Single-Mode
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing SR-IOV implementation on GPUs incurs unnecessary overhead due to the isolation policy, which prevents virtual functions from modifying the GPU state, even when operating in single-VF mode.
Innovation Solution
The system allows a virtual function (VF) to modify the state of a GPU by determining the operating mode, enabling interrupts and state modifications in single-VF mode, and disabling them in multi-VF mode, thereby reducing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the isolation policy is enforced to prevent VFs from modifying GPU state, then security and integrity are improved, but overhead increases due to handshake requirements
Solution Approach 1:
The system dynamically adjusts the isolation policy based on the operational mode. In single-VF mode, the isolation policy is relaxed to allow direct state modification without handshake overhead. In multi-VF mode, the strict isolation policy with handshake requirements is enforced to maintain GPU state integrity. This dynamic adaptation resolves the contradiction by making the security measure conditional rather than absolute.
Solution Approach 2:
The system changes the parameter of isolation policy strictness based on the number of active VFs. When operating in single-VF mode, the isolation parameter is adjusted to permit direct state modifications. When multiple VFs are active, the isolation parameter is tightened to require host driver mediation. This parameter change allows the system to optimize performance when security risks are minimal while maintaining security when risks increase.
2Reliability
If the handshake protocol is required for state modifications, then security is improved, but productivity decreases due to additional communication steps
Solution Approach 1:
The handshake protocol requirement is made dynamic rather than static. In single-VF mode, the system transitions to a direct modification path that eliminates the handshake protocol, thereby improving productivity. In multi-VF mode, the handshake protocol is activated to ensure security. This dynamic behavior allows the system to achieve high productivity when security constraints are relaxed and maintains security when multiple VFs are present.
Solution Approach 2:
The handshake protocol is extracted as an optional component rather than a mandatory one. In single-VF mode, the handshake step is completely removed from the state modification path, allowing direct and efficient modifications. In multi-VF mode, the handshake protocol is re-introduced as a security gate. This extraction approach allows the system to eliminate unnecessary security overhead when it doesn't apply while maintaining it when needed.
3Reliability
If interrupts are disabled for VFs, then GPU state security is improved, but ease of operation worsens for performance analysis tools
Solution Approach 1:
The interrupt enablement status is made dynamic based on operational mode. In single-VF mode, interrupts from the VF to the system management unit are enabled, allowing performance analysis tools to efficiently modify GPU state and receive notifications. In multi-VF mode, interrupts are disabled to maintain security and prevent unauthorized state modifications. This dynamic control resolves the contradiction by enabling interrupts only when security risks are minimal.
Data Source
AI summary
A processing system includes physical function circuitry to execute virtual functions and a processing unit configured to operate in a first mode that allows more than one virtual function to execute on the physical function circuitry and a second mode that constrains the physical function circuitry to executing a single virtual function. A first virtual function modifies a state of the processing unit in response to the processing unit being in the second mode. A host driver executing on the processing unit modifies an operating mode indicator to indicate that the processing unit is operating in the first mode or to indicate that the processing unit is operating in the second mode. Microcode executing on the processing unit accesses the operating mode indicator to determine whether the processing unit is operating in the first mode or the second mode.