diff options
Diffstat (limited to 'docs/03-architecture')
| -rw-r--r-- | docs/03-architecture/14-multi-tenant-gmmu-protection.md | 36 |
1 files changed, 22 insertions, 14 deletions
diff --git a/docs/03-architecture/14-multi-tenant-gmmu-protection.md b/docs/03-architecture/14-multi-tenant-gmmu-protection.md index c3f58c7..060a600 100644 --- a/docs/03-architecture/14-multi-tenant-gmmu-protection.md +++ b/docs/03-architecture/14-multi-tenant-gmmu-protection.md @@ -1,6 +1,6 @@ # Multi-Tenant GMMU Protection: Isolation Design and Paged-Attention Controls -> **Status: design (2026-10-08, master `66388560`).** This document specifies +> **Status: design (2026-10-08, master `1f571dda`).** This document specifies > how Open-IOV isolates multiple tenants — multiple mdevs *and* multiple > tenants inside one guest — at the GPU memory-management unit (GMMU), and how > a paged-attention inference stack (vLLM-style) can use those protections. @@ -119,9 +119,9 @@ The **work/completion service is not**. `gsp_sema_service.c` holds one global `static struct sema_svc svc;` (`kernel/gsp_sema_service.c:676`), and: * the service thread pumps **the first open mdev it finds** - (`kernel/gsp_sema_service.c:13296-13308`); + (`kernel/gsp_sema_service.c:13352-13364`); * the work-submission doorbell carries no owner — `gsp_sema_service_doorbell(u32 token)` - (`kernel/gsp_sema_service.c:13456`), called from the VFIO write path with + (`kernel/gsp_sema_service.c:13512`), called from the VFIO write path with no mdev argument (`kernel/main.c:865`); * channel registrations are keyed by the guest-chosen `h_object` alone (`kernel/gsp_sema_service.c:847`, table bounded by `SVC_MAX_CHANNELS 128` @@ -146,9 +146,11 @@ problem.** §2 fixes the ownership; §4 builds the GMMU policy on it. **Tenant** — isolation principal (`tenantId`): a VM/mdev at L0–L2, a logical serving principal inside a guest in §4. **Agent** — finest principal inside a tenant (`agentId`): a vLLM engine/worker, a CUDA context, a process. -**vEP** — virtual execution plane: the per-instance mediator (guest -emulation + work execution) for one mdev; see -[`13-vexecution-plane.md`](13-vexecution-plane.md). **KV block** — +**vEP** — the vGSP Execution Plane: the execution half of vGSP (guest work → +physical execution → guest-visible completion), as defined in +[`13-vexecution-plane.md`](13-vexecution-plane.md). This document's problem +is that the vEP's work-service state is currently one global context rather +than per-mdev. **KV block** — paged-attention cache page (vLLM `paged_attention_v2`: fixed-size blocks, one `block_tables` entry per logical block per sequence); a GPU allocation range, not a hardware object. @@ -171,9 +173,9 @@ What exists and what changes: | `svc.chan[]` | keyed `h_object` (`gsp_sema_service.c:847`) | key `(vgpu, h_object)`; per-mdev lifetime reset | | `svc.vas[]` | keyed `h_vaspace` (`:988`) | key `(vgpu, h_vaspace)` | | learned VA→PA map / pins | keyed GPU VA (`:113-130`) | key `(vgpu, VA)`; per-mdev epoch | -| doorbell token | ownerless (`:13456`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump | +| doorbell token | ownerless (`:13512`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump | | completion counters | global boot state | per mdev, reset on session/rebind | -| pump | first open mdev (`:13296-13308`) | per-mdev pump (or round-robin over all open mdevs) | +| pump | first open mdev (`:13352-13364`) | per-mdev pump (or round-robin over all open mdevs) | The GMMU half of address-space separation is the page directory: each VA space has one, published by the guest through `SET_PAGE_DIRECTORY` with its @@ -258,7 +260,7 @@ mdev's address space, and a completion event is posted only to the owning mdev's event object. Today the release path resolves the target VA through *global* tables -(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,1514`) +(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,2474`) and posts through `gsp_rm_post_channel_event()` on the emulation context (`kernel/gsp_rm_emulation.c:602`). The first is the cross-tenant hazard: a release record decoded from guest A's push buffer could resolve through a @@ -581,8 +583,10 @@ The requested chain, end to end: ### 4.4 Design A — VA-subtree partitioning (no guest KMD change) -This is the **stock-compatible** design and the one that can be prototyped -inside the 1.0 programme. It relies on one idea: **the VA space is the +This is the **stock-compatible** design and the research entry point: it is +the only design that needs no guest KMD change, but its prototype is M6 — +post-1.0, dual-gated, and it does not shape baseline 1.0 code (§7.4). It +relies on one idea: **the VA space is the security domain, and a VA is self-describing because its prefix encodes its owner.** @@ -1090,6 +1094,10 @@ starts after 1.0 goals are met, on an explicit human decision. CUDA reproducibility and per-client state issues M1 resolves; `../../debug/risc-v-gsp-rm-vm/docs/{43-GMMU-PTE-DECODER,44-GMMU-ORACLE-AND-WORKFLOW,23-RM610-READINESS}.md` — tooling and gates cited above. -* Local analysis: `LOCAL-MULTI-TENANT-GMMU.md` (adjacent; part of the - local analysis) — provenance behind §4.2 and the unredacted design - reasoning. + +## Change log + +| Date | Change | +|---|---| +| 2026-10-08 | Created: multi-mdev service-state ownership rules, isolation-layer model, VRAM oversubscription design, paged-attention tenant/agent protection stack (Design A/B, three granularities), walked example, portability, M1–M8 roadmap. Tree `66388560`. | +| 2026-10-08 | Review pass: status hash refreshed to `master @ 1f571dda`; drifted line anchors updated for the post-`66388560` code (pump loop, doorbell, `svc_sem_write`); the vEP vocabulary aligned with doc 13 (13 is the vocabulary authority, this document the GMMU-policy authority); Design A classified as the research entry point (M6), not a 1.0 programme item. | |