User-Level Interrupts in Virtual Machines via Nested IOMMU Posting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems incur significant latency and resource wastage due to multiple privilege level transitions when delivering interrupts to user-level applications in virtual machines, leading to inefficient use of resources and increased power consumption.
Innovation Solution
Implementing user-level posted interrupts using nested posting of interrupts through an I/O memory management unit (IOMMU) to directly deliver interrupts to guest user applications in virtual machines without taking a virtual machine exit or privilege level transition, utilizing hardware, software, or firmware for interrupt remapping and posting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If interrupts are delivered through traditional kernel-based mechanisms with privilege level transitions, then system security and control are maintained, but interrupt delivery latency increases and resource utilization decreases
Solution Approach 1:
The interrupt delivery mechanism is segmented into two independent data structures: a first interrupt data structure for guest user applications and a second interrupt data structure for virtual CPU notifications. This segmentation allows parallel processing paths, enabling the IOMMU to post interrupts directly to user space without requiring sequential privilege level transitions through the kernel, thereby reducing interrupt delivery latency while maintaining system control through the virtualization layer.
2Productivity
If user-level posted interrupts are implemented directly without kernel involvement, then interrupt delivery latency is reduced, but system security and interrupt routing control may be compromised
Solution Approach 1:
The IOMMU acts as an intermediary that implements nested posting functionality, enabling direct interrupt delivery to user-level applications while maintaining secure routing control. The IOMMU uses the first interrupt data structure to post interrupts to guest user applications and the second interrupt data structure to notify virtual CPUs, thereby providing both low-latency delivery and reliable routing control through hardware-based interrupt remapping and validation.
Solution Approach 2:
The interrupt delivery mechanism employs nested posting where the IOMMU first posts an interrupt to a user-level data structure (first interrupt data structure), which then triggers a notification to the virtual CPU through a second data structure (second interrupt data structure). This nested approach allows user-level applications to receive interrupts directly without kernel involvement, improving resource utilization while the virtualization layer maintains overall system control through the nested notification mechanism.
3Use of energy by stationary object
If multiple privilege level transitions are required for interrupt delivery, then system security is maintained, but power consumption increases due to frequent context switches
Solution Approach 1:
The interrupt delivery path is extracted from the traditional kernel-based privilege level transition mechanism and delivered directly to user-level applications through the IOMMU's nested posting capability. By taking out the kernel involvement from the critical interrupt delivery path, the system eliminates multiple context switches and privilege level transitions, thereby reducing power consumption while maintaining security through the IOMMU's hardware-based interrupt remapping and the virtualization layer's oversight.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A system comprises a physical processor to execute a virtual machine manager to run, on a logical core, a virtual machine including a guest user application and a virtual CPU. Circuitry coupled to an external device is to receive an interrupt request from the external device for the guest user application, locate a first interrupt data structure associated with the guest user application, generate a first interrupt with the first interrupt data structure based on a first interrupt vector for the interrupt request, locate a second interrupt data structure associated with the virtual CPU, and generate a first notification interrupt for the virtual CPU with the second interrupt data structure based on a first notification vector in the first interrupt data structure. The circuitry may generate a second notification interrupt for the logical core using a second notification vector and a logical core identifier from the second interrupt data structure.