Security for microengine access

Patent metadata

Field	Value
Publication number	US-11768696-B2
Application number	US-202017121678-A
Country	US
Kind code	B2
Filing date	Dec 14, 2020
Priority date	Dec 14, 2020
Publication date	Sep 26, 2023
Grant date	Sep 26, 2023

Abstract

A technique for managing access to a micro engine, the method comprising: determining that a virtual function “VF”) is to be given access to direct communication with a micro engine; in response to the determining, configuring the micro engine to accept direct communication from the VF; monitoring for unpermitted communication; and after a time period has expired, configuring the micro engine to no longer accept direct communication from the VF.

First claim

What is claimed is:

1. A method for managing access to a micro engine, the method comprising:
during a virtual machine initialization period, determining that a virtual function (“VF”) associated with the virtual machine is to be given access to direct communication with the micro engine;
in response to the determining, configuring the micro engine to accept direct communication from the VF through an interrupt-based doorbell mechanism; and
after a pre-programmed time period has expired, configuring the micro engine to no longer accept direct communication from the VF via the interrupt-based doorbell mechanism.

2. The method of claim 1 , wherein the determining occurs in response to the VF being initialized or deinitialized.

3. The method of claim 1 , wherein configuring the micro engine to accept direct communication from the VF includes enabling an interrupt on the micro engine.

4. The method of claim 3 , wherein enabling the interrupt includes enabling the interrupt for the VF but not for other VFs.

5. The method of claim 3 , wherein enabling the interrupt includes enabling the interrupt for the VF and other VFs.

6. The method of claim 1 , further comprising monitoring for unpermitted communication, wherein the unpermitted communication includes a doorbell of the micro engine being accessed with a frequency that is higher than a threshold frequency.

7. The method of claim 1 , further comprising monitoring for unpermitted communication, wherein the unpermitted communication includes the VF providing a number of invalid requests to the micro engine, wherein the number is greater than a threshold.

8. The method of claim 1 , further comprising, further comprising monitoring for unpermitted communication, and, in response to detecting unpermitted communication, configuring the micro engine to no longer accept direct communication from the VF.

9. The method of claim 1 , wherein configuring the micro engine to no longer accept direct communication from the VF includes disabling interrupts associated with the direct communication.

10. A device, comprising:
a set of one or more processors operating as micro engines; and
a permissions agent comprising one of a micro engine access agent or microcode executing in one or more micro engines of the set of micro engines,
wherein the permissions agent is configured to
during a virtual machine initialization period, determine that a virtual function (“VF”) associated with the virtual machine is to be given access to direct communication with a micro engine of the set of one or more micro engines;
in response to the determining, configure the micro engine to accept direct communication from the VF through an interrupt-based doorbell mechanism; and
after a pre-programmed time period has expired, configure the micro engine to no longer accept direct communication from the VF via the interrupt-based doorbell mechanism.

11. The device of claim 10 , wherein the determining occurs in response to the VF being initialized or deinitialized.

12. The device of claim 10 , wherein configuring the micro engine to accept direct communication from the VF includes enabling an interrupt on the micro engine.

13. The device of claim 12 , wherein enabling the interrupt includes enabling the interrupt for the VF but not for other VFs.

14. The device of claim 12 , wherein enabling the interrupt includes enabling the interrupt for the VF and other VFs.

15. The device of claim 10 , wherein the permissions agent is further configured to monitor for unpermitted communication, wherein the unpermitted communication includes a doorbell of the micro engine being accessed with a frequency that is higher than a threshold frequency.

16. The device of claim 10 , wherein the permissions agent is further configured to monitor for unpermitted communication, wherein the unpermitted communication includes the VF providing a number of invalid requests to the micro engine, wherein the number is greater than a threshold.

17. The device of claim 10 , wherein the permissions agent is further configured to monitor for unpermitted communication, wherein the permissions agent is further configured to, in response to detecting unpermitted communication, configure the micro engine to no longer accept direct communication from the VF.

18. The device of claim 10 , wherein configuring the micro engine to no longer accept direct communication from the VF includes disabling interrupts associated with the direct communication.

19. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to:
during a virtual machine initialization period, determine that a virtual function (“VF”) associated with the virtual machine is to be given access to direct communication with a micro engine;
in response to the determining, configure the micro engine to accept direct communication from the VF through an interrupt-based doorbell mechanism;
monitor for unpermitted communication; and
after a pre-programmed time period has expired, configure the micro engine to no longer accept direct communication from the VF via the interrupt-based doorbell mechanism.

20. The non-transitory computer-readable medium of claim 19 , wherein the determining occurs in response to the VF being initialized or deinitialized.

Assignees

• Ati Technologies Ulc

Inventors

• Jiang Yinan
• Nasim Kamraan
• Ming Dezhi
• Abdelkhalek Ahmed M
• Chenchykov Dmytro
• Sung Andy

Classifications

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F9/45545

  Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox · CPC title

• G06F9/4812

  by interrupt, e.g. masked · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title