PASID-Based I/O Resource Isolation for Per-Container Queue Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Input/Output (I/O) resource partitioning techniques are inadequate for per-process or per-container assignment, failing to provide effective isolation and flexible queue pair allocation in computing systems, especially with the emergence of multi-core processors and advanced storage technologies.
Innovation Solution
The implementation of Process Address Space Identifier (PASID) support on PCIe endpoints, enabling per-queue PASID registers for DMA requests and secure I/O partitioning with software control, allows for flexible assignment and isolation of I/O resources at a granular level, utilizing PASID functionality and TLP prefixes to tag DMA requests with specific address spaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If traditional I/O resource partitioning techniques are used, then system simplicity is maintained, but I/O resource isolation granularity is insufficient for per-process or per-container assignment
Solution Approach 1:
The patent segments I/O resources by introducing per-queue PASID registers, allowing each queue pair to be independently associated with a specific process address space. This enables fine-grained isolation at the queue level rather than requiring coarse-grained device-level partitioning, resolving the contradiction between isolation granularity and system complexity
Solution Approach 2:
The patent adds a new dimension of identification by incorporating PASID into the TLP prefix structure. This additional identification layer enables multi-dimensional resource tracking (device + queue + process address space) without fundamentally redesigning the existing PCIe architecture, achieving fine-grained isolation while maintaining system compatibility
2Adaptability or versatility
If per-queue PASID registers are implemented for DMA requests, then I/O resource assignment flexibility is improved, but hardware device complexity increases
Solution Approach 1:
The patent implements PASID functionality locally at the queue pair level through per-queue PASID registers, rather than requiring global changes to the entire hardware device. This allows flexible resource assignment for specific queues while keeping the rest of the device architecture unchanged, resolving the contradiction between flexibility and complexity
Solution Approach 2:
The per-queue PASID registers serve multiple functions: they enable process address space identification, support secure I/O partitioning, and facilitate on-demand queue pair allocation. This multi-functionality achieves high adaptability without proportionally increasing hardware complexity
3Productivity
If instances directly access assigned I/O resources, then data copying overhead is reduced, but security requirements for resource isolation increase
Solution Approach 1:
The patent introduces PASID as an intermediary identifier that bridges instances and I/O resources. The PASID embedded in TLP prefixes acts as a mediator that enables direct access while maintaining security through hardware-enforced address space association, resolving the contradiction between access efficiency and isolation security
Data Source
AI summary
Disclosed herein are systems and methods for isolating input/output computing resources. In some embodiments, a host device may include logic to identify a Process Address Space Identifier (PASID) for a process or container of the host device and logic to associate the PASID with an individual queue pair of a hardware device of the host device, wherein the queue pair includes two complementary queues and wherein the queue pair is owned by the process or container upon association with the PASID. Other embodiments may be disclosed and/or claimed.