Access control in peer-to-peer transactions over a peripheral component bus

1. Computing apparatus, comprising:

a central processing unit (CPU), which is configured to run concurrently multiple virtual machines, including at least first and second virtual machines;

a peripheral component bus, connected to communicate with the CPU;

multiple peripheral devices, connected to communicate via the bus with the CPU and with others of the peripheral devices, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines; and

access control logic, which is configured to forward peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines,

wherein the peripheral devices are configured to associate respective entity identifiers with the functional entities, and wherein the access control logic is configured to maintain a table indicating a respective access permission level for each pair of a source entity identifier in a source peripheral device and a destination entity identifier in a destination peripheral device.

2. The apparatus according to claim 1 , wherein the access control logic is embedded in at least the first peripheral device and is configured to screen the communications initiated by the functional entities in the first peripheral device before transmitting the communications to the bus.

3. The apparatus according to claim 1 , wherein the access control logic is embedded in the second peripheral device and is configured to screen the communications received from the bus before delivering the communications to the functional entities in the second peripheral device.

4. The apparatus according to claim 1 , wherein the peripheral component bus comprises a switch, which is configured to transfer the communications between the peripheral devices, and wherein the access control logic is embedded in the switch.

5. The apparatus according to claim 4 , wherein the access control logic in the switch is configured to filter the communications between the functional entities without forwarding the communications to a root complex of the bus.

6. The apparatus according to claim 1 , wherein each entry indicates, for a corresponding pair of source and destination entity identifiers, whether access is fully permitted, access is limited, or access is denied, and wherein the access control logic is configured to inhibit the peer-to-peer communications when the access is limited or denied.

7. Computing apparatus, comprising:

a central processing unit (CPU), which is configured to run concurrently multiple virtual machines, including at least first and second virtual machines;

a peripheral component bus, connected to communicate with the CPU;

multiple peripheral devices, connected to communicate via the bus with the CPU and with others of the peripheral devices, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines; and

access control logic, which is configured to forward peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines,

wherein the peripheral component bus comprises a switch, which is configured to transfer the communications between the peripheral devices, and wherein the access control logic is embedded in the switch, and

wherein at least the first peripheral device is configured to assign different, respective requester identifiers to at least the first and second functional entities of the first peripheral device, and to incorporate the respective requester identifiers in headers of packets transmitted over the peripheral component bus to carry the peer-to-peer communications initiated by the functional entities, and

wherein the access control logic is configured to decide whether to forward or inhibit the peer-to-peer communications based on the requester identifiers in the headers.

8. A method for operating a computer, which includes a central processing unit (CPU) and multiple peripheral devices, which are connected to communicate via a peripheral component bus with the CPU and with others of the peripheral devices, the method comprising:

concurrently running multiple virtual machines, including at least first and second virtual machines, on the CPU;

partitioning at least some of the peripheral devices into multiple functional entities, including at least first and second peripheral devices that are each respectively partitioned into at least first and second functional entities, which are respectively assigned to serve the at least first and second virtual machines;

associating respective entity identifiers with the functional entities; and

forwarding peer-to-peer communications initiated by the functional entities between the peripheral devices over the bus while inhibiting access in the peer-to-peer communications between the functional entities that are assigned to different ones of the virtual machines,

wherein forwarding the peer-to-peer communications comprises maintaining a table indicating a respective access permission level for each pair of a source entity identifier in a source peripheral device and a destination entity identifier in a destination peripheral device.

9. The method according to claim 8 , wherein forwarding the peer-to-peer communications comprises screening the communications initiated by the functional entities in the first peripheral device using access control logic embedded in at least the first peripheral device before transmitting the communications to the bus.

10. The method according to claim 8 , wherein forwarding the peer-to-peer communications comprises screening the communications received from the bus by the second peripheral device using access control logic embedded in the second peripheral device before delivering the communications to the functional entities in the second peripheral device.

11. The method according to claim 8 , wherein forwarding the peer-to-peer communications comprises transferring the communications through a switch on the peripheral component bus, and wherein inhibiting the access comprises screening the communications using access control logic embedded in the switch.

12. The method according to claim 11 , wherein screening the communications comprises filtering the communications between the functional entities in the switch without forwarding the communications to a root complex of the bus.

13. The method according to claim 11 , and comprising:

assigning different, respective requester identifiers to at least the first and second functional entities of the first peripheral device; and

incorporating the respective requester identifiers in headers of packets transmitted over the peripheral component bus to carry the peer-to-peer communications initiated by the functional entities,

wherein screening the communications comprises deciding whether to forward or inhibit the peer-to-peer communications based on the requester identifiers in the headers.

14. The method according to claim 8 , wherein each entry indicates, for a corresponding pair of source and destination entity identifiers, whether access is fully permitted, access is limited, or access is denied, and wherein inhibiting the access comprises inhibiting the peer-to-peer communications when the access is limited or denied.