Trust domains for peripheral devices

Abstract

Disclosed are various embodiments for various approaches for implementing trust domains to provide boundaries between PCIe devices connected to the same PCIe switch. A first trust identifier can be assigned to a first virtual machine hosted by the computing device. The first trust identifier can also be assigned to a first PCIe device assigned to the first virtual machine. Later, it can be determined that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine. An Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch can be disabled in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.

Therefore, the following is claimed: 
     
         1 . A system, comprising:
 a computing device comprising a processor, a memory, and a Peripheral Component Interconnect Express (PCIe) switch; and   machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
 determine that a first PCIe device connected to the PCIe switch is assigned a first trust identifier assigned to a first virtual machine; 
 determine that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine; and 
 disable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine. 
   
     
     
         2 . The system of  claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
 assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;   determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and   enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.   
     
     
         3 . The system of  claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
 assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;   determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;   determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and   disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.   
     
     
         4 . The system of  claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
 detect that the first PCIe device has been unassigned from the first virtual machine;   assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;   determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and   enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.   
     
     
         5 . The system of  claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
 detect that the first PCIe device has been unassigned from the first virtual machine;   assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;   determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled; and   determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and   disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.   
     
     
         6 . The system of  claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
 detect that a third PCIe device has been assigned to the first virtual machine;   determine that each PCIe device connected to the PCIe switch is assigned the first trust identifier; and   enable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response a determination that each PCIe device connected to the PCIe switch is assigned the first trust identifier.   
     
     
         7 . The system of  claim 1 , wherein assignment of the first trust identifier to the first virtual machine and the first PCIe device occurs in response to the first virtual machine being powered on. 
     
     
         8 . A method, comprising:
 determining that a first PCIe device connected to the PCIe switch is assigned a first trust identifier assigned to a first virtual machine;   determining that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine; and   disabling an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.   
     
     
         9 . The method of  claim 8 , further comprising:
 assigning a default trust identifier to the first PCIe device in response to powering off the virtual machine;   determining that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and   enabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.   
     
     
         10 . The method of  claim 8 , further comprising:
 assigning a default trust identifier to the first PCIe device in response to powering off of the virtual machine;   determining that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;   determining that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and   disabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.   
     
     
         11 . The method of  claim 8 , further comprising:
 detecting that the first PCIe device has been unassigned from the first virtual machine;   assigning a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;   determining that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and   enabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.   
     
     
         12 . The method of  claim 8 , further comprising:
 detecting that the first PCIe device has been unassigned from the first virtual machine;   assigning a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;   determining that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;   determining that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and   disabling the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.   
     
     
         13 . The method of  claim 8 , further comprising:
 detecting that a third PCIe device has been assigned to the first virtual machine;   determining that each PCIe device connected to the PCIe switch is assigned the first trust identifier; and   enabling an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response a determination that each PCIe device connected to the PCIe switch is assigned the first trust identifier.   
     
     
         14 . The method of  claim 8 , wherein assigning of the first trust identifier to the first virtual machine and the first PCIe device occurs in response to the first virtual machine being powered on. 
     
     
         15 . A non-transitory, computer-readable medium, comprising machine-readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:
 determine that a first PCIe device connected to the PCIe switch is assigned a first trust identifier assigned to a first virtual machine;   determine that a second PCIe device connected to the PCIe switch is assigned a second trust identifier assigned to a second virtual machine; and   disable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the second PCIe device is associated with the second trust identifier assigned to the second virtual machine.   
     
     
         16 . The non-transitory, computer-readable medium of  claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
 assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;   determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and   enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.   
     
     
         17 . The non-transitory, computer-readable medium of  claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
 assign a default trust identifier to the first PCIe device in response to a power off of the virtual machine;   determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled;   determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and   disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.   
     
     
         18 . The non-transitory, computer-readable medium of  claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
 detect that the first PCIe device has been unassigned from the first virtual machine;   assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;   determine that each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier; and   enable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch in response to a determination that the each PCIe device connected to the PCIe switch is assigned either the default trust identifier or the second trust identifier.   
     
     
         19 . The non-transitory, computer-readable medium of  claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
 detect that the first PCIe device has been unassigned from the first virtual machine;   assign a default trust identifier to the first PCIe device in response to the first PCIe device being unassigned from the first virtual machine;   determine that a third PCIe device connected to the PCIe switch is assigned the first trust identifier and that the third PCIe device has Address Translation Services (ATS) enabled; and   determine that the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch is currently enabled; and   disable the ACS direct translated bit for peer-to-peer memory requests in the PCIe switch.   
     
     
         20 . The non-transitory, computer-readable medium of  claim 15 , wherein the machine-readable instructions further cause the computing device to at least:
 detect that a third PCIe device has been assigned to the first virtual machine;   determine that each PCIe device connected to the PCIe switch is assigned the first trust identifier; and   enable an Address Control Services (ACS) direct translated bit for peer-to-peer memory requests in the PCIe switch in response a determination that each PCIe device connected to the PCIe switch is assigned the first trust identifier.