IDPT Bitmap Access Control for Scalable Cross-Address-Space Data Movement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for cross-address-space data movement in computing systems face scalability challenges due to the need for O(N^2) connections between address spaces, leading to increased hardware and software complexity and performance overhead.
Innovation Solution
Implementing a single Inter-Domain Permissions Table (IDPT) entry that allows multiple submitters to access a target address space using an access control bitmap, reducing the scaling to O(N) by enabling N:1 connections and sparse memory mapping to conserve memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional 1:1 connection model is used between address spaces for cross-address-space data movement, then access control can be implemented, but the system scalability deteriorates due to O(N^2) connections requirement
Solution Approach 1:
The patent applies universality by making a single IDPT entry serve multiple requester address spaces simultaneously. Instead of dedicating one IDPT entry per requester-address-space pair, the invention allows one IDPT entry to be shared by N requesters through the access control bitmap mechanism, reducing the total number of IDPT entries from O(N^2) to O(N).
Solution Approach 2:
The patent changes the parameter representation by introducing an access control bitmap that encodes multiple requester address space permissions within a single IDPT entry. The bitmap uses bit positions to represent different requester address spaces, allowing the system to check access permissions for multiple requesters against a single IDPT entry rather than requiring separate entries for each requester.
2Reliability
If multiple IDPT entries are created to allow different submitters to access a target address space, then access control precision is improved, but hardware complexity increases
Solution Approach 1:
The patent merges multiple access control checks into a single IDPT entry by combining the requester address space identifiers into a bitmap field. This merging allows the hardware to perform a single lookup operation that simultaneously validates permissions for multiple requester address spaces, rather than requiring separate lookup operations for each requester.
Solution Approach 2:
The patent adds a new dimension to the IDPT entry structure by incorporating a bitmap field that encodes multiple requester address space permissions. This dimensional expansion allows the system to store and check permissions for N requester address spaces within a single IDPT entry, effectively adding a layer of multiplexing to the traditional one-to-one mapping.
3Reliability
If a 1:1 IDPT entry mapping is used for each submitter, then access control can be enforced, but memory usage increases
Solution Approach 1:
The patent makes each IDPT entry universal by allowing it to serve multiple requester address spaces through the access control bitmap. This multi-functionality reduces the total number of IDPT entries required from O(N^2) to O(N), where N is the number of requester address spaces, thereby reducing the memory footprint of the IDPT structure.
Solution Approach 2:
The patent uses a bitmap as a compact representation that copies permission information for multiple requester address spaces into a single data structure. Instead of creating full copies of IDPT entries for each requester, the system uses bit positions in the bitmap to represent different requester address spaces, providing a space-efficient encoding of access control information.
Data Source
AI summary
Methods and apparatus relating to scalable access control checking for cross-address-space data movement are described. In an embodiment, a memory stores an Inter-Domain Permissions Table (IDPT) having a plurality of entries. At least one entry of the IDPT provides a relationship between a target address space identifier and a plurality of requester address space identifiers. A hardware accelerator device allows access to a target address space, corresponding to the target address space identifier, by one or more of requesters, corresponding to the plurality of requester address space identifiers, respectively, based at least in part on the relationship provided by the at least one entry of the IDPT. Other embodiments are also disclosed and claimed.