I/O Device Controller Isolation for Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current I/O virtualization solutions, such as SR-IOV, introduce complexity and high costs due to circuit complexity when multiple I/O devices share a common controller, particularly in scenarios where distinct I/O devices need to access different DMA pages mapped to different virtual machines.
Innovation Solution
A system architecture that utilizes a common I/O device controller with isolation provisions, including an IOMMU, to manage and configure distinct mappings of input/output devices for multiple virtual machines, ensuring secure and isolated access through a memory-mapped I/O scheme, allowing protected virtual machines to handle sensitive operations while general virtual machines access shared devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SR-IOV interface is used to allow multiple I/O devices to access different DMA pages mapped to different VMs, then I/O device access versatility is improved, but device complexity and fabrication cost increase due to circuit complexity and large die size
Solution Approach 1:
The patent segments the I/O device access management by introducing a virtualization layer that divides physical I/O devices into virtual I/O devices, each可 be independently assigned to different VMs. This segmentation allows multiple VMs to access different DMA pages through virtualized I/O devices without requiring complex circuitry in each physical device, thereby resolving the contradiction between versatility and complexity.
Solution Approach 2:
The patent introduces an I/O memory management unit (IOMMU) as an intermediary between physical I/O devices and VMs. The IOMMU handles address translation and access control, enabling multiple I/O devices to access different DMA pages mapped to different VMs without requiring complex circuitry in the I/O devices themselves. This intermediary approach resolves the contradiction by centralizing the complexity in a dedicated management unit rather than distributing it across all I/O devices.
2Adaptability or versatility
If SR-IOV interface is used to allow multiple I/O devices to access different DMA pages mapped to different VMs, then I/O device access versatility is improved, but device complexity and fabrication cost increase due to large die size
Solution Approach 1:
The patent segments the I/O device access management by introducing a virtualization layer that divides physical I/O devices into virtual I/O devices, each可 be independently assigned to different VMs. This segmentation allows multiple VMs to access different DMA pages through virtualized I/O devices without requiring complex circuitry in each physical device, thereby resolving the contradiction between versatility and complexity.
Solution Approach 2:
The patent makes the IOMMU a universal component that can be shared by multiple I/O devices. Instead of each I/O device having dedicated complex circuitry for address translation and access control, a single IOMMU serves multiple devices, reducing the overall die size while maintaining the ability to support multiple VMs with different DMA page mappings.
3Device complexity
If multiple I/O devices share a common controller, then device complexity is reduced, but isolation and security are compromised when distinct devices need to access different DMA pages
Solution Approach 1:
The patent introduces an I/O memory management unit (IOMMU) as an intermediary between physical I/O devices and VMs. The IOMMU handles address translation and access control, enabling multiple I/O devices to access different DMA pages mapped to different VMs without requiring complex circuitry in the I/O devices themselves. This intermediary approach resolves the contradiction by centralizing the complexity in a dedicated management unit rather than distributing it across all I/O devices.
Solution Approach 2:
The patent implements local quality by providing each VM with isolated access rights to specific DMA pages through the IOMMU. Each VM has its own address space and access permissions, ensuring that even though multiple I/O devices share a common controller, each VM can only access its designated DMA pages. This local isolation maintains security and reliability while allowing the common controller to serve multiple devices.
Data Source
AI summary
Embodiments are directed to managing access to input/output devices by virtual machines (VMs). A first VM and a second VM are implemented. An I/O device controller driver has a first driver portion in the first VM and a second driver portion in the second VM. The first driver portion includes a configuration engine to configure the I/O device controller with I/O device-VM mappings, where a first I/O device is mapped exclusively to the first VM, and a second I/O device is mapped to at least the second VM. The second VM includes a general processing engine to call for I/O devices via the second driver portion, and in response to a call by the general processing engine for access to the first I/O device the second driver portion is to send an access request to the first driver portion.