TRUST DOMAINS FOR PERIPHERAL DEVICES
Disclosed are various embodiments for various approaches for implementing trust domains to provide boundaries between PCIe devices connected to the same PCIe switch. A first trust identifier can be assigned to a first virtual machine hosted by the computing device. The first trust identifier can also be assigned to a first PCIe device assigned to the first virtual machine. Later, it can be determined that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine. An Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch can be disabled in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.
1 . A system, comprising:
a computing device comprising a processor, a memory, and a Peripheral Component Interconnect Express (PCIe) switch; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
determine that a first PCIe device connected to the PCIe switch is assigned a first trust identifier assigned to a first virtual machine;
determine that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine; and
disable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.
2 . The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;
determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and
enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.
3 . The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;
determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;
determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and
disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.
4 . The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
detect that the first PCIe device has been unassigned from the first virtual machine;
assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;
determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and
enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.
5 . The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
detect that the first PCIe device has been unassigned from the first virtual machine;
assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;
determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled; and
determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and
disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.
6 . The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
detect that a third PCIe device has been assigned to the first virtual machine;
determine that each PCIe device connected to the PCIe switch is assigned the first trust identifier; and
enable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response a determination that each PCIe device connected to the PCIe switch is assigned the first trust identifier.
7 . The system of claim 1 , wherein assignment of the first trust identifier to the first virtual machine and the first PCIe device occurs in response to the first virtual machine being powered on.
8 . A method, comprising:
determining that a first PCIe device connected to the PCIe switch is assigned a first trust identifier assigned to a first virtual machine;
determining that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine; and
disabling an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.
9 . The method of claim 8 , further comprising:
assigning a default trust identifier to the first PCIe device in response to powering off the virtual machine;
determining that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and
enabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.
10 . The method of claim 8 , further comprising:
assigning a default trust identifier to the first PCIe device in response to powering off of the virtual machine;
determining that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;
determining that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and
disabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.
11 . The method of claim 8 , further comprising:
detecting that the first PCIe device has been unassigned from the first virtual machine;
assigning a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;
determining that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and
enabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.
12 . The method of claim 8 , further comprising:
detecting that the first PCIe device has been unassigned from the first virtual machine;
assigning a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;
determining that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;
determining that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and
disabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.
13 . The method of claim 8 , further comprising:
detecting that a third PCIe device has been assigned to the first virtual machine;
determining that each PCIe device connected to the PCIe switch is assigned the first trust identifier; and
enabling an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response a determination that each PCIe device connected to the PCIe switch is assigned the first trust identifier.
14 . The method of claim 8 , wherein assigning of the first trust identifier to the first virtual machine and the first PCIe device occurs in response to the first virtual machine being powered on.
15 . A non-transitory, computer-readable medium, comprising machine-readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:
determine that a first PCIe device connected to the PCIe switch is assigned a first trust identifier assigned to a first virtual machine;
determine that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine; and
disable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.
16 . The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;
determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and
enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.
17 . The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;
determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;
determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and
disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.
18 . The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
detect that the first PCIe device has been unassigned from the first virtual machine;
assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;
determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and
enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.
19 . The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
detect that the first PCIe device has been unassigned from the first virtual machine;
assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;
determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled; and
determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and
disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.
20 . The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
detect that a third PCIe device has been assigned to the first virtual machine;
determine that each PCIe device connected to the PCIe switch is assigned the first trust identifier; and
enable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response a determination that each PCIe device connected to the PCIe switch is assigned the first trust identifier.