Access control in peer-to-peer transactions over a peripheral component bus

Patent metadata

Field	Value
Publication number	US-10303647-B2
Application number	US-201615202590-A
Country	US
Kind code	B2
Filing date	Jul 6, 2016
Priority date	Jul 15, 2015
Publication date	May 28, 2019
Grant date	May 28, 2019

Abstract

Computing apparatus includes a central processing unit (CPU), which is configured to run concurrently multiple virtual machines, including at least first and second virtual machines. A peripheral component bus is connected to communicate with the CPU. Multiple peripheral devices are connected to communicate via the bus with the CPU and with others of the peripheral devices, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines. Access control logic is configured to forward peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines.

First claim

The invention claimed is:

1. Computing apparatus, comprising:
a central processing unit (CPU), which is configured to run concurrently multiple virtual machines, including at least first and second virtual machines;
a peripheral component bus, connected to communicate with the CPU;
multiple peripheral devices, connected to communicate via the bus with the CPU and with others of the peripheral devices, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines; and
access control logic, which is configured to forward peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines,
wherein the peripheral devices are configured to associate respective entity identifiers with the functional entities, and wherein the access control logic is configured to maintain a table indicating a respective access permission level for each pair of a source entity identifier in a source peripheral device and a destination entity identifier in a destination peripheral device.

2. The apparatus according to claim 1 , wherein the access control logic is embedded in at least the first peripheral device and is configured to screen the communications initiated by the functional entities in the first peripheral device before transmitting the communications to the bus.

3. The apparatus according to claim 1 , wherein the access control logic is embedded in the second peripheral device and is configured to screen the communications received from the bus before delivering the communications to the functional entities in the second peripheral device.

4. The apparatus according to claim 1 , wherein the peripheral component bus comprises a switch, which is configured to transfer the communications between the peripheral devices, and wherein the access control logic is embedded in the switch.

5. The apparatus according to claim 4 , wherein the access control logic in the switch is configured to filter the communications between the functional entities without forwarding the communications to a root complex of the bus.

6. The apparatus according to claim 1 , wherein each entry indicates, for a corresponding pair of source and destination entity identifiers, whether access is fully permitted, access is limited, or access is denied, and wherein the access control logic is configured to inhibit the peer-to-peer communications when the access is limited or denied.

7. Computing apparatus, comprising:
a central processing unit (CPU), which is configured to run concurrently multiple virtual machines, including at least first and second virtual machines;
a peripheral component bus, connected to communicate with the CPU;
multiple peripheral devices, connected to communicate via the bus with the CPU and with others of the peripheral devices, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines; and
access control logic, which is configured to forward peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines,
wherein the peripheral component bus comprises a switch, which is configured to transfer the communications between the peripheral devices, and wherein the access control logic is embedded in the switch, and
wherein at least the first peripheral device is configured to assign different, respective requester identifiers to at least the first and second functional entities of the first peripheral device, and to incorporate the respective requester identifiers in headers of packets transmitted over the peripheral component bus to carry the peer-to-peer communications initiated by the functional entities, and
wherein the access control logic is configured to decide whether to forward or inhibit the peer-to-peer communications based on the requester identifiers in the headers.

8. A method for operating a computer, which includes a central processing unit (CPU) and multiple peripheral devices, which are connected to communicate via a peripheral component bus with the CPU and with others of the peripheral devices, the method comprising:
concurrently running multiple virtual machines, including at least first and second virtual machines, on the CPU;
partitioning at least some of the peripheral devices into multiple functional entities, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines;
associating respective entity identifiers with the functional entities; and
forwarding peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines,
wherein forwarding the peer-to-peer communications comprises maintaining a table indicating a respective access permission level for each pair of a source entity identifier in a source peripheral device and a destination entity identifier in a destination peripheral device.

9. The method according to claim 8 , wherein forwarding the peer-to-peer communications comprises screening the communications initiated by the functional entities in the first peripheral device using access control logic embedded in at least the first peripheral device before transmitting the communications to the bus.

10. The method according to claim 8 , wherein forwarding the peer-to-peer communications comprises screening the communications received from the bus by the second peripheral device using access control logic embedded in the second peripheral device before delivering the communications to the functional entities in the second peripheral device.

11. The method according to claim 8 , wherein forwarding the peer-to-peer communications comprises transferring the communications through a switch on the peripheral component bus, and wherein inhibiting the access comprises screening the communications using access control logic embedded in the switch.

12. The method according to claim 11 , wherein screening the communications comprises filtering the communications between the functional entities in the switch without forwarding the communications to a root complex of the bus.

13. The method according to claim 11 , and comprising:
assigning different, respective requester identifiers to at least the first and second functional entities of the first peripheral device; and
incorporating the respective requester identifiers in headers of packets transmitted over the peripheral component bus to carry the peer-to-peer communications initiated by the functional entities,
wherein screening the communications comprises deciding whether to forward or inhibit the peer-to-peer communications based on the requester identifiers in the headers.

14. The method according to claim 8 , wherein each entry indicates, for a corresponding pair of source and destination entity i

Assignees

• Mellanox Technologies Ltd

Inventors

• Menachem Adi
• Raindel Shachar

Classifications

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F13/4282

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• G06F15/17331 Primary

  Distributed shared memory [DSM], e.g. remote direct memory access [RDMA] · CPC title

• G06F2009/45579

  I/O management, e.g. providing access to device drivers or storage · CPC title

• G06F13/4022 Primary

  using switching circuits, e.g. switching matrix, connection or expansion network (G06F13/4009 takes precedence) · CPC title