I/O Resource Isolation via PASID Tag ID Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current I/O resource partitioning techniques are inadequate for isolating input/output resources at a fine enough granularity to effectively utilize high-core-count processors and support thousands of active virtual execution environments, especially with emerging technologies like high-throughput network adapters and non-volatile memory devices.
Innovation Solution
The implementation of a pseudo device-level resource isolation mechanism using Process Address Space Identifiers (PASIDs) and Transaction Layer Packets (TLPs) to securely manage I/O resources, allowing for fine-grained isolation and secure access to I/O devices by associating unique identifiers with queue pairs and performing privilege checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If traditional I/O resource partitioning techniques are used, then system simplicity is maintained, but I/O resource isolation granularity is insufficient for high-core-count processors and thousands of virtual execution environments
Solution Approach 1:
The patent segments I/O resources by introducing queue pair-level isolation mechanisms, where each virtual execution environment can be assigned specific queue pairs from I/O devices. This divides the I/O resource management into finer granular units (queue pairs) rather than device-level or function-level allocations, enabling thousands of virtual environments to share I/O resources with proper isolation.
Solution Approach 2:
The patent introduces PASID (Process Address Space Identifier) as an intermediary mechanism between the processor and I/O devices. The PASID acts as a mediator that enables the processor to identify and manage multiple virtual execution environments' I/O access requests without requiring complex hardware modifications to the I/O devices themselves, thus improving isolation granularity while controlling system complexity.
2Adaptability or versatility
If fine-grained I/O resource isolation is implemented, then support for thousands of virtual execution environments is enabled, but resource management complexity increases
Solution Approach 1:
The patent makes the I/O resource management system universal by designing a queue pair assignment mechanism that can accommodate any number of virtual execution environments (from a few to thousands) on the same hardware platform. The PASID and queue pair assignment framework provides a unified approach that works across different I/O device types and configurations, enabling flexible adaptation to various virtualization scales without requiring device-specific complex management.
3Productivity
If queue pair-level isolation is implemented, then I/O resource utilization efficiency improves, but privilege check overhead increases
Solution Approach 1:
The patent performs preliminary assignment of queue pairs to virtual execution environments during system initialization or resource allocation phases. The PASID to queue pair mappings are pre-configured and cached, so that during actual I/O operations, the processor can quickly verify permissions using pre-computed PASID values without performing complex real-time privilege checks, thus reducing time overhead while maintaining fine-grained isolation.
Data Source
AI summary
Disclosed herein are systems and methods for isolating input/output computing resources. In some embodiments, a host device may include a processor and logic coupled with the processor, to identify a tag identifier (Tag ID) for a process or container of the host device. The Tag ID may identify a queue pair of a hardware device of the host device for an outbound transaction from the processor to the hardware device, to be conducted by the process or container. Logic may further map the Tag ID to a Process Address Space Identifier (PASID) associated with an inbound transaction from the hardware device to the processor that used the identified queue pair. The process or container may use the PASID to conduct the outbound transaction via the identified queue pair. Other embodiments may be disclosed and/or claimed.