Physically distributed control plane firewalls with unified software view
Various embodiments include techniques for processing transactions via a computer system interconnect with a distributed firewall. The distributed firewall includes separate firewalls for various initiators of transactions and separate firewalls for various targets of those transactions. As a result, transactions proceed, for example, along the shortest path from the initiator to the target, rather than being routed through a centralized firewall. In addition, firewall transactions, for example, may be remapped such that initiators address the initiator firewalls and target firewalls via a unified address space, without having to maintain separate base addresses for each initiator firewall and target firewall. As a result, application programs, for example, can execute transactions with increased performance on a computer system as compared to prior approaches.
1 . A computer-implemented method for processing a first transaction via an interconnect comprising a two-dimensional mesh network, the method comprising:
receiving the first transaction from an initiator via a first node included in the two-dimensional mesh network;
determining that the first transaction is directed at a first firewall;
suspending execution of the first transaction;
generating a map that merges memory address spaces of a plurality of firewalls including the first firewall into a unified memory address space that has a single firewall base address for all firewalls included in the plurality of firewalls, wherein each firewall included in the plurality of firewalls is addressed by adding the single firewall base address to an offset that is different for each firewall included in the plurality of firewalls;
modifying, via the map, a memory address included in the first transaction and in a first memory address format in a memory address space of the first firewall to generate a modified memory address in a second memory address format in the unified memory address space; and
transmitting, via a second node included in the two-dimensional mesh network, the first transaction including the modified memory address to a target coupled to the first firewall.
2 . The computer-implemented method of claim 1 , wherein:
the first firewall comprises an initiator firewall that performs a first authorization function on a second transaction, and
a second firewall comprising a target firewall performs a second authorization function on the second transaction.
3 . The computer-implemented method of claim 2 , wherein the first authorization function comprises determining that an initiator associated with the initiator firewall is authorized to direct the second transaction towards a memory address space that includes a second memory address included in the second transaction.
4 . The computer-implemented method of claim 2 , wherein the second authorization function comprises determining that whether an initiator associated with the initiator firewall is authorized to direct the second transaction towards a target protected by the target firewall.
5 . The computer-implemented method of claim 1 , further comprising, subsequent to suspending the execution of the first transaction, forwarding the first transaction to a firewall remapper.
6 . The computer-implemented method of claim 1 , further comprising, subsequent to modifying the memory address included in the first transaction to generate the modified memory address, forwarding the first transaction to an address space associated with the modified memory address.
7 . The computer-implemented method of claim 1 , wherein the first firewall comprises an initiator firewall and a target firewall, and further comprising:
determining a path between an initiator and at least one of the initiator firewall or the target firewall through a plurality of nodes included in the interconnect; and
transmitting the first transaction from the initiator to the at least one of the initiator firewall or the target firewall via the path.
8 . The computer-implemented method of claim 1 , wherein the first memory address format comprises:
a base address of a firewall address space that includes a plurality of address spaces corresponding to a plurality of firewalls that includes the first firewall; and
an offset associated with the first firewall.
9 . The computer-implemented method of claim 1 , wherein the second memory address format comprises:
a base address of a firewall address space that corresponds to the first firewall; and
an offset associated with the first firewall.
10 . The computer-implemented method of claim 1 , wherein the first firewall comprises an initiator firewall that is configured to perform authorization functions for a plurality of initiators.
11 . The computer-implemented method of claim 1 , wherein the first firewall comprises a target firewall that is configured to perform authorization functions for a plurality of targets.
12 . The computer-implemented method of claim 1 , wherein the first firewall comprises an initiator firewall that is coupled to a first node included in a plurality of nodes within the interconnect, and a second firewall comprises a target firewall that is coupled to the first node.
13 . The computer-implemented method of claim 1 , wherein the first firewall comprises an initiator firewall that is coupled to a first node included in a plurality of nodes within the interconnect, and a second firewall comprises a target firewall that is coupled to a second node included in the plurality of nodes.
14 . A system, comprising:
an initiator firewall comprising a first microprocessor executing instructions stored in a first memory;
a target firewall comprising a second microprocessor executing instructions stored in a second memory;
a firewall trap that:
receives a first transaction from an initiator coupled to the initiator firewall via a first node included in a two-dimensional mesh network;
determines that a first transaction is directed at the initiator firewall or the target firewall, and
suspends execution of the first transaction;
a firewall remapper that:
generates a map that merges memory address spaces of a plurality of firewalls including the initiator firewall and the target firewall into a unified memory address space that has a single firewall base address for all firewalls included in the plurality of firewalls, wherein each firewall included in the plurality of firewalls is addressed by adding the single firewall base address to an offset that is different for each firewall included in the plurality of firewalls, and
modifies, via the map, a memory address included in the first transaction and in a first memory address format in a memory address space of the initiator firewall or the target firewall to generate a modified memory address in a second memory address format in the unified memory address space; and
an interconnect comprising a two-dimensional mesh network that transmits, via a second node included in the two-dimensional mesh network, the first transaction including the modified memory address to the initiator coupled to the initiator firewall or a target coupled to the target firewall.
15 . The system of claim 14 , wherein:
the initiator firewall performs a first authorization function on a second transaction, and
the target firewall performs a second authorization function on the second transaction.
16 . The system of claim 15 , wherein the first authorization function comprises determining that an initiator associated with the initiator firewall is authorized to direct the second transaction towards a memory address space that includes a second memory address included in the second transaction.
17 . The system of claim 15 , wherein the second authorization function comprises determining that whether an initiator associated with the initiator firewall is authorized to direct the second transaction towards a target protected by the target firewall.
18 . The system of claim 14 , wherein, subsequent to suspending execution of the first transaction, the firewall trap further forwards the first transaction to the firewall remapper.
19 . The system of claim 14 , wherein, subsequent to the firewall remapper modifying the memory address included in the first transaction to generate the modified memory address, the firewall trap further forwards the first transaction to an address space associated with the modified memory address.
20 . The system of claim 14 , wherein the system further comprises an initiator associated with the initiator firewall and a target associated with the target firewall, and wherein the interconnect further:
determines a path between the initiator and the target through a plurality of nodes included in the interconnect; and
transmits a second transaction from the initiator to the target via the path.