Authenticating shared interconnect fabrics

Patent metadata

Field	Value
Publication number	US-9542350-B1
Application number	US-201313860857-A
Country	US
Kind code	B1
Filing date	Apr 11, 2013
Priority date	Apr 13, 2012
Publication date	Jan 10, 2017
Grant date	Jan 10, 2017

Abstract

A method of authenticating shared peripheral component interconnect express devices of a switched fabric includes associating at least one requester identifier with a physical function of a device on the switched fabric and instantiating a virtual function of the device based on the physical function. The virtual function includes the associated at least one requester identifier. The method further includes accepting memory-mapped input/output traffic through the virtual function only from a requester having a corresponding requester identifier matching an associated requester identifier of the virtual function. The method may also include allowing a write operation of the virtual function or the physical function only to an address residing within an allowable address range associated with the device.

First claim

What is claimed is:

1. A method of authenticating access to shared peripheral devices on a switched interconnection fabric, the method comprising:
associating at least one permitted requester identifier with a physical function of a device on the switched fabric;
instantiating a virtual function of the device based on the physical function, the virtual function inheriting the associated at least one permitted requester identifier;
receiving a memory-mapped input/output (MMIO) request at the virtual function;
comparing, at the virtual function, a requester identifier of the MMIO request with the at least one permitted requester identifier of the virtual function;
if the requester identifier of the MMIO request matches the at least one permitted requester identifier of the virtual function:
accepting, by the virtual function, the MMIO request, and
allowing, by the virtual function, the accepted MMIO request to access a memory address space allocated to a host corresponding to the request identifier; and

if the request identifier of the MMIO request does not match the at least one permitted requester identifier of the virtual function, denying, by the virtual function, access to the memory address space to the MMIO request.

2. The method of claim 1 , wherein the requester identifier comprises a sender identifier of a Peripheral Component Interconnect Express transport level packet.

3. The method of claim 1 , further comprising defining a physical function register to store the associated at least one permitted requester identifier.

4. The method of claim 3 , further comprising:
defining an authoritative requester identifier field for each instantiated virtual function of the physical function; and
associating a set of enable bits with each authoritative requester identifier field.

5. The method of claim 4 , wherein the set of enable bits comprise at least one of a bus matching bit, a device matching bit, a function matching bit, or a filter function enable bit.

6. The method of claim 5 , wherein the device ignores the associated at least one requester identifier of the physical function when bus matching is cleared.

7. The method of claim 5 , wherein the device responds to memory-mapped input/output request packets having requester identifiers with a bus portion matching a corresponding bus portion of an associated requester identifier of the physical function when the bus matching bit is set.

8. The method of claim 5 , wherein the device responds to memory-mapped input/output request packets having requester identifiers with a bus portion and a device portion both matching a corresponding bus portion and a corresponding device portion of a requester identifier associated with the physical function when the bus matching bit and the device matching bit are both set.

9. The method of claim 5 , wherein the device responds to memory-mapped input/output request packets having requester identifiers with all bits matching corresponding bits of a requester identifier associated with the physical function when the bus matching bit, the device matching bit, and the function bit are each set.

10. The method of claim 5 , further comprising instantiating the virtual function with the same set of enable bits as the physical function.

11. The method of claim 10 , wherein the virtual function can be referenced only by a root complex or peer device designated by the requester identifier associated with the physical function when the bus matching bit of the virtual function is cleared.

12. The method of claim 10 , wherein the virtual function responds to memory-mapped input/output request packets having requester identifiers with a bus portion matching a corresponding bus portion of an associated requester identifier of the virtual function when the bus matching bit is set.

13. The method of claim 10 , wherein the virtual function responds to memory-mapped input/output request packets having requester identifiers with a bus portion and a device portion both matching a corresponding bus portion and a corresponding device portion of an associated requester identifier of the virtual function when the bus matching bit and the device matching bit are both set.

14. The method of claim 10 , wherein the virtual function responds to memory-mapped input/output request packets having requester identifiers with all bits matching corresponding bits of an associated requester identifier of the virtual function when the bus matching bit, the device matching bit, and the function bit are each set.

15. The method of claim 1 , further comprising allowing a write operation of the virtual function or the physical function only to an address residing within an allowable address range associated with the device.

16. The method of claim 15 , further comprising associating one or more allowable address ranges of the device to each virtual function.

17. The method of claim 16 , further comprising associating an address base and an address length for the one or more allowable address ranges.

18. A switched fabric authentication system comprising:
shared peripheral interconnection network devices of a switched fabric, each device configured to:
associate at least one permitted requester identifier with a physical function of the device;
instantiate a virtual function of the device based on the physical function, the virtual function including the associated at least one requester identifier;
receive a memory-mapped input/output (MMIO) request at the virtual function;
compare, at the virtual function, a requester identifier of the MMIO request with the at least one permitted requester identifier of the virtual function;
if the requester identifier of the MMIO traffic matches the at least one permitted requester identifier of the virtual function:
accept, by the virtual function, the MMIO request, and
allow, by the virtual function, the accepted MMIO request to access a memory address space allocated to a host corresponding to the request identifier; and

if the request identifier of the MMIO request odes not match the at least one permitted requester identifier of the virtual function, deny, by the virtual function, access to the memory address space to the MMIO request.

19. The switched fabric authentication system of claim 18 , wherein the requester identifier comprises a sender identifier of a peripheral component interconnect express transport level packet.

20. The switched fabric authentication system of claim 18 , wherein each device includes a physical function register storing the associated at least one requester identifier.

21. The switched fabric authentication system of claim 20 , wherein each device includes an authoritative requester identifier field for each associated requester identifier of the physical function, each authoritative requester identifier field having an associated set of enable bits.

22. The switched fabric authentication system of claim 21 , wherein the set of enable bits comprise at least one of a bus matching bit, a device matching bit, a function matching bit, or a filter function enablement bit.

23. The switched fabric authentication system of claim 22 , wherein each device ignores the associated at least one requester identifier of the physical function when the bus matching bit is cleared.

24. The switched fabric authentication system of claim 22 , wherein each device responds to memory-mapped input/output request packets having r

Assignees

• Google Inc

Inventors

• Kissell Kevin D
• Serebrin Benjamin Charles

Classifications

• G06F13/4068 Primary

  Electrical coupling · CPC title

• G06F13/14

  Handling requests for interconnection or transfer · CPC title