I/O Device Translation and Protection Unit for Virtualized Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized data processing systems, the mediation of the hypervisor in the I/O path adds significant overhead and reduces performance due to inefficiencies in address translation and protection for I/O devices, particularly when untrusted guest operating systems supply DMA addresses, leading to potential system integrity compromises.
Innovation Solution
The system employs an I/O device with a translation and protection unit (TPU) that performs virtual address translation and memory protection for I/O operations, allowing the device to selectively choose between performing these functions at the TPU or the IOMMU based on predefined criteria, thereby reducing the translation bottleneck and maintaining system integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the hypervisor mediates I/O operations in virtualised systems, then system integrity and security are maintained, but I/O performance deteriorates due to additional processing overhead and context switches
Solution Approach 1:
The patent introduces a translation agent as an intermediary component that mediates between the I/O device and the hypervisor. The translation agent handles address translation and protection functions, allowing the hypervisor to maintain security oversight while reducing its direct involvement in every I/O operation. This intermediary layer processes I/O requests more efficiently than the hypervisor alone, thereby improving I/O performance while preserving system integrity through the translation agent's security enforcement capabilities.
2Reliability
If address translation is performed at the IOMMU for all I/O operations, then memory protection is ensured, but translation overhead increases and bottlenecks occur
Solution Approach 1:
The patent implements local quality by allowing different I/O devices to perform address translation at different locations based on their specific requirements. Some devices can perform translation locally at the device itself, while others use the IOMMU or translation agent. This differentiated approach ensures that memory protection is maintained where needed while avoiding unnecessary translation overhead for operations that don't require it, thereby reducing bottlenecks and improving overall system performance.
3Productivity
If guests are given direct access to I/O devices, then I/O performance is improved, but system security is compromised as untrusted guests could access unauthorized memory regions
Solution Approach 1:
The translation agent serves as a security intermediary that sits between the guest's direct access to the I/O device and the host memory. When a guest initiates an I/O operation through the device, the translation agent intercepts the address translation request, verifies the guest's authorization, and performs the translation only if security checks pass. This allows guests to have direct device access for performance while the translation agent maintains security by preventing unauthorized memory access.
Solution Approach 2:
The translation agent enables a form of self-service security model where the I/O device itself participates in the security enforcement process. The device can indicate whether an operation requires translation and protection, and the translation agent autonomously handles the security checks and address translation without requiring hypervisor intervention for each operation. This self-service approach maintains security while improving performance by reducing hypervisor overhead.
Data Source
Figure 1~2
AI summary
A data processing system comprising: a memory addressable by a range of physical memory addresses; a plurality of non-privileged software domains each having a virtual memory address space; at least one privileged software domain; a memory management unit operable to perform virtual address translation of a virtual memory address into a physical memory address; and an input and/or output device supporting a plurality of virtualised interfaces, each virtualised interface being associated with a respective one of the non-privileged software domains, the input and/or output device further comprising at least one operation management unit operable to perform virtual address translation in one or more of the virtual memory address spaces.