PIM Virtual Address Partitioning for Secure Process Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-processing environments, concurrent access to shared PIM resources by multiple processes can lead to functional incorrectness and security vulnerabilities, such as corruption of PIM registers and side channel data leaks.
Innovation Solution
Implementations provide software and hardware support for process isolation in PIM devices using virtualization, ensuring that only one process can orchestrate PIM resources at a time by allocating exclusive virtual address spaces and enforcing valid mappings between virtual and physical addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple processes concurrently access shared PIM resources, then resource utilization is improved, but functional incorrectness and security vulnerabilities occur
Solution Approach 1:
The patent segments the PIM device's configuration space and execution resources into separate virtual address spaces for different processes. Each process receives a dedicated virtual address space that maps to specific physical resources, preventing concurrent access conflicts while allowing parallel execution. This segmentation resolves the contradiction by enabling multiple processes to utilize PIM resources simultaneously without corrupting each other's execution.
Solution Approach 2:
The patent introduces a virtualization layer as an intermediary between processes and physical PIM resources. This virtualization mechanism includes virtual address spaces, page tables, and a translation mechanism that mediates access between multiple processes and the shared physical PIM device. The intermediary ensures isolation and security while enabling concurrent resource utilization.
2Reliability
If virtualization is implemented to isolate PIM access, then execution security is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal virtualization framework that handles multiple functions: process isolation, address translation, resource allocation, and security protection. By designing a multi-functional virtualization layer that can manage various aspects of process isolation and resource access, the system achieves execution security without proportionally increasing complexity. The same virtualization mechanisms serve multiple purposes simultaneously.
Data Source
AI summary
Process isolation for a PIM device includes: receiving, from a process, a call to allocate a virtual address space where the process stores a PIM configuration context; allocating the virtual address space including mapping a physical address space including PIM device configuration registers to the virtual address space only if the physical address space is not mapped to another process's virtual address space; and programming the PIM device configuration space according to the configuration context. When a PIM command is executed, a translation mechanism determines whether there is a valid mapping of a virtual address of the PIM command to a physical address of a PIM resource, such as a LIS entry. If a valid mapping exists, the translation is completed and the resource is accessed, but if there is not a valid mapping, the translation fails and the process is blocked from accessing the PIM resource.