diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/03-architecture/14-multi-tenant-gmmu-protection.md | 36 | ||||
| -rw-r--r-- | docs/README.md | 35 |
2 files changed, 42 insertions, 29 deletions
diff --git a/docs/03-architecture/14-multi-tenant-gmmu-protection.md b/docs/03-architecture/14-multi-tenant-gmmu-protection.md index c3f58c7..060a600 100644 --- a/docs/03-architecture/14-multi-tenant-gmmu-protection.md +++ b/docs/03-architecture/14-multi-tenant-gmmu-protection.md @@ -1,6 +1,6 @@ # Multi-Tenant GMMU Protection: Isolation Design and Paged-Attention Controls -> **Status: design (2026-10-08, master `66388560`).** This document specifies +> **Status: design (2026-10-08, master `1f571dda`).** This document specifies > how Open-IOV isolates multiple tenants — multiple mdevs *and* multiple > tenants inside one guest — at the GPU memory-management unit (GMMU), and how > a paged-attention inference stack (vLLM-style) can use those protections. @@ -119,9 +119,9 @@ The **work/completion service is not**. `gsp_sema_service.c` holds one global `static struct sema_svc svc;` (`kernel/gsp_sema_service.c:676`), and: * the service thread pumps **the first open mdev it finds** - (`kernel/gsp_sema_service.c:13296-13308`); + (`kernel/gsp_sema_service.c:13352-13364`); * the work-submission doorbell carries no owner — `gsp_sema_service_doorbell(u32 token)` - (`kernel/gsp_sema_service.c:13456`), called from the VFIO write path with + (`kernel/gsp_sema_service.c:13512`), called from the VFIO write path with no mdev argument (`kernel/main.c:865`); * channel registrations are keyed by the guest-chosen `h_object` alone (`kernel/gsp_sema_service.c:847`, table bounded by `SVC_MAX_CHANNELS 128` @@ -146,9 +146,11 @@ problem.** §2 fixes the ownership; §4 builds the GMMU policy on it. **Tenant** — isolation principal (`tenantId`): a VM/mdev at L0–L2, a logical serving principal inside a guest in §4. **Agent** — finest principal inside a tenant (`agentId`): a vLLM engine/worker, a CUDA context, a process. -**vEP** — virtual execution plane: the per-instance mediator (guest -emulation + work execution) for one mdev; see -[`13-vexecution-plane.md`](13-vexecution-plane.md). **KV block** — +**vEP** — the vGSP Execution Plane: the execution half of vGSP (guest work → +physical execution → guest-visible completion), as defined in +[`13-vexecution-plane.md`](13-vexecution-plane.md). This document's problem +is that the vEP's work-service state is currently one global context rather +than per-mdev. **KV block** — paged-attention cache page (vLLM `paged_attention_v2`: fixed-size blocks, one `block_tables` entry per logical block per sequence); a GPU allocation range, not a hardware object. @@ -171,9 +173,9 @@ What exists and what changes: | `svc.chan[]` | keyed `h_object` (`gsp_sema_service.c:847`) | key `(vgpu, h_object)`; per-mdev lifetime reset | | `svc.vas[]` | keyed `h_vaspace` (`:988`) | key `(vgpu, h_vaspace)` | | learned VA→PA map / pins | keyed GPU VA (`:113-130`) | key `(vgpu, VA)`; per-mdev epoch | -| doorbell token | ownerless (`:13456`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump | +| doorbell token | ownerless (`:13512`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump | | completion counters | global boot state | per mdev, reset on session/rebind | -| pump | first open mdev (`:13296-13308`) | per-mdev pump (or round-robin over all open mdevs) | +| pump | first open mdev (`:13352-13364`) | per-mdev pump (or round-robin over all open mdevs) | The GMMU half of address-space separation is the page directory: each VA space has one, published by the guest through `SET_PAGE_DIRECTORY` with its @@ -258,7 +260,7 @@ mdev's address space, and a completion event is posted only to the owning mdev's event object. Today the release path resolves the target VA through *global* tables -(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,1514`) +(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,2474`) and posts through `gsp_rm_post_channel_event()` on the emulation context (`kernel/gsp_rm_emulation.c:602`). The first is the cross-tenant hazard: a release record decoded from guest A's push buffer could resolve through a @@ -581,8 +583,10 @@ The requested chain, end to end: ### 4.4 Design A — VA-subtree partitioning (no guest KMD change) -This is the **stock-compatible** design and the one that can be prototyped -inside the 1.0 programme. It relies on one idea: **the VA space is the +This is the **stock-compatible** design and the research entry point: it is +the only design that needs no guest KMD change, but its prototype is M6 — +post-1.0, dual-gated, and it does not shape baseline 1.0 code (§7.4). It +relies on one idea: **the VA space is the security domain, and a VA is self-describing because its prefix encodes its owner.** @@ -1090,6 +1094,10 @@ starts after 1.0 goals are met, on an explicit human decision. CUDA reproducibility and per-client state issues M1 resolves; `../../debug/risc-v-gsp-rm-vm/docs/{43-GMMU-PTE-DECODER,44-GMMU-ORACLE-AND-WORKFLOW,23-RM610-READINESS}.md` — tooling and gates cited above. -* Local analysis: `LOCAL-MULTI-TENANT-GMMU.md` (adjacent; part of the - local analysis) — provenance behind §4.2 and the unredacted design - reasoning. + +## Change log + +| Date | Change | +|---|---| +| 2026-10-08 | Created: multi-mdev service-state ownership rules, isolation-layer model, VRAM oversubscription design, paged-attention tenant/agent protection stack (Design A/B, three granularities), walked example, portability, M1–M8 roadmap. Tree `66388560`. | +| 2026-10-08 | Review pass: status hash refreshed to `master @ 1f571dda`; drifted line anchors updated for the post-`66388560` code (pump loop, doorbell, `svc_sem_write`); the vEP vocabulary aligned with doc 13 (13 is the vocabulary authority, this document the GMMU-policy authority); Design A classified as the research entry point (M6), not a 1.0 programme item. | diff --git a/docs/README.md b/docs/README.md index fe39077..13f0ae5 100644 --- a/docs/README.md +++ b/docs/README.md @@ -173,20 +173,21 @@ Read in order if you are new. Jump directly if you know what you need. | 13 | [Physical GPU integration](03-architecture/08-physical-gpu-integration.md) | developers, architects | 20 min | | 14 | [Physical backend guest wiring](03-architecture/11-physical-backend-guest-wiring.md) | developers, architects | 25 min | | 15 | [The vGSP execution plane (vEP)](03-architecture/13-vexecution-plane.md) | developers, architects | 25 min | -| 16 | [The execution frontier: the GR compute-launch chain](04-implementation/03-execution-frontier.md) | developers, debuggers | 15 min | -| 17 | [Host VF acceleration — future goal (deferred)](03-architecture/12-host-vf-acceleration-future-goal.md) | architects, planners | 10 min | -| 18 | [Known-knowns and known-unknowns](04-implementation/01-known-knowns-and-unknowns.md) | everyone technical | 25 min | -| 19 | [Practical challenges and adversarial interoperability](04-implementation/02-practical-challenges-and-adversarial-interop.md) | developers, stakeholders | 20 min | -| 20 | [Performance, correctness, security](05-operations/01-performance-correctness-security.md) | developers, auditors | 25 min | -| 21 | [Debugging and maintenance workflows](05-operations/02-debugging-and-maintenance-workflows.md) | developers, maintainers | 25 min | -| 22 | [GSP in a RISC-V VM (risc-v-gsp-rm-debugger, experimental)](05-operations/03-risc-v-gsp-rm-vm.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min | -| 23 | [risc-v-gsp-rm-debugger user guide (experimental)](05-operations/04-risc-v-gsp-rm-debugger-user-guide.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min | -| 24 | [Defensive Operations Runbook](RUNBOOK.md) | maintainers, operators | 20 min | -| 25 | [Engineering operations](eng-ops.md) — tool admission and workflows (Part I) plus live physical-backend operations (Part II) | maintainers, developers | 20 min | -| 26 | [Hardware and software matrix](06-portability/hardware-software-matrix.md) | developers, integrators | 20 min | -| 27 | [Developer onboarding and standards](07-developers/onboarding-and-standards.md) | contributors | 20 min | -| 28 | [HAAEEP and collaboration](08-ecosystem/haaeep-and-collaboration.md) | stakeholders, partners | 20 min | -| 29 | [Glossary and FAQ](09-reference/glossary-and-faq.md) | everyone | reference | +| 16 | [Multi-tenant GMMU protection](03-architecture/14-multi-tenant-gmmu-protection.md) | developers, architects, security reviewers | 25 min | +| 17 | [The execution frontier: the GR compute-launch chain](04-implementation/03-execution-frontier.md) | developers, debuggers | 15 min | +| 18 | [Host VF acceleration — future goal (deferred)](03-architecture/12-host-vf-acceleration-future-goal.md) | architects, planners | 10 min | +| 19 | [Known-knowns and known-unknowns](04-implementation/01-known-knowns-and-unknowns.md) | everyone technical | 25 min | +| 20 | [Practical challenges and adversarial interoperability](04-implementation/02-practical-challenges-and-adversarial-interop.md) | developers, stakeholders | 20 min | +| 21 | [Performance, correctness, security](05-operations/01-performance-correctness-security.md) | developers, auditors | 25 min | +| 22 | [Debugging and maintenance workflows](05-operations/02-debugging-and-maintenance-workflows.md) | developers, maintainers | 25 min | +| 23 | [GSP in a RISC-V VM (risc-v-gsp-rm-debugger, experimental)](05-operations/03-risc-v-gsp-rm-vm.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min | +| 24 | [risc-v-gsp-rm-debugger user guide (experimental)](05-operations/04-risc-v-gsp-rm-debugger-user-guide.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min | +| 25 | [Defensive Operations Runbook](RUNBOOK.md) | maintainers, operators | 20 min | +| 26 | [Engineering operations](eng-ops.md) — tool admission and workflows (Part I) plus live physical-backend operations (Part II) | maintainers, developers | 20 min | +| 27 | [Hardware and software matrix](06-portability/hardware-software-matrix.md) | developers, integrators | 20 min | +| 28 | [Developer onboarding and standards](07-developers/onboarding-and-standards.md) | contributors | 20 min | +| 29 | [HAAEEP and collaboration](08-ecosystem/haaeep-and-collaboration.md) | stakeholders, partners | 20 min | +| 30 | [Glossary and FAQ](09-reference/glossary-and-faq.md) | everyone | reference | <!-- change (2026-10-02): insert the risc-v-gsp-rm-debugger user guide and the Open-IOV Defensive Operations Runbook into the reading list; renumber rows 21-24 to @@ -202,7 +203,11 @@ additive only. --> <!-- change (2026-10-08): insert "The vGSP execution plane (vEP)" as row 15 (architecture: the work path); renumber rows 15-28 to 16-29; additive only. --> -Row 17 is a **deferred future goal**: host NVIDIA-driver acceleration over a +<!-- change (2026-10-08): insert "Multi-tenant GMMU protection" as row 16 +(architecture: isolation design, companion to the vEP doc); renumber rows +16-29 to 17-30; additive only. --> + +Row 18 is a **deferred future goal**: host NVIDIA-driver acceleration over a virtual function. The feasibility verdict and a first design sketch are recorded there for planning; it is not on the active critical path (guest CUDA execution, multi-VM, 3D, performance come first). |