Physically distributed control plane firewall with a unified software view

Abstract

This disclosure relates to a physically distributed control plane firewall with a unified software view. Various embodiments include techniques for processing transactions via interconnection between a computer system and a distributed firewall. The distributed firewall includes separate firewalls for each initiator of a transaction and separate firewalls for each destination of those transactions. Thus, for example, transactions proceed along the shortest path from the initiator to the destination, rather than being routed through a centralized firewall. Furthermore, for example, firewall transactions can be remapped so that the initiator addresses the initiator firewall and the destination firewall via a unified address space, rather than having to maintain separate base addresses for each initiator firewall and the destination firewall. Therefore, compared to existing methods, applications can, for example, perform transactions with increased performance on the computer system.

Description

TECHNICAL FIELD

[0001] Various embodiments relate generally to parallel processing computing architectures, and more particularly to a physically distributed control plane firewall with a unified software view. BACKGROUND

[0002] Among other things, a computer system typically includes one or more processing units, such as central processing units (CPUs) and / or graphics processing units (GPUs), one or more memory systems, registers, input / output (I / O devices), etc. In operation, the various components of the computer system act as initiators, as targets, or as both initiators and targets. When a component acts as an initiator, the component directs a transaction, such as a load operation or a store operation, through an interconnected system and toward another component in the computer system, referred to as a target. In some examples, an initiator can perform a load operation to retrieve one or more data values from a memory location and / or a register included in the target. Similarly, in some examples, an initiator can perform a store operation to store one or more data values to a memory location and / or a register included in the target. The physical path from the initiator to the target's register configuration space or other control space is referred to herein as the control plane. Typical components that act as initiators include CPUs and GPUs. Typical components that act as targets include memory systems, registers, and I / O devices. I / O devices that act as targets include universal asynchronous receivers / transmitters (UARTs), serial peripheral interfaces (SPIs), Ethernet controllers, etc. Further, a CPU can initiate transactions that specify a GPU or another CPU as a target. Similarly, a GPU can initiate transactions that specify a CPU or another GPU as a target.

[0003] Generally, a computer system that includes multiple initiators and multiple targets can employ a firewall mechanism, or more simply, a firewall for security purposes. The firewall acts as a security system that monitors and controls incoming and outgoing transactions across the interconnected system to ensure that each initiator accesses only the memory address spaces and / or other targets that the initiator is allowed to access. The firewall prevents an application executing on one initiator from inadvertently or intentionally interfering with an application executing on another initiator. With the firewall, each transaction generated by an initiator is received by the firewall, and the firewall determines whether the initiator is authorized to direct the transaction to the memory address space and / or other target specified by the transaction. If the firewall determines that the initiator is not authorized to direct the transaction to the memory address space and / or other target, the firewall blocks the transaction. On the other hand, if the firewall determines that the initiator is authorized to direct the transaction to the memory address space and / or other target, the firewall allows the transaction to proceed.

[0004] This approach of aggregating all transactions to the firewall can work well for small to medium sized computer systems. However, some larger computer systems can have hundreds or even thousands of initiators and targets. In such large computer systems, because the firewall processes transactions for hundreds or thousands of initiators, the firewall can become a bottleneck, resulting in reduced bandwidth, increased latency, and reduced computing power, resulting in a significant decrease in performance of the computer system.

[0005] As described above, what is needed in the art is a more efficient technique for implementing a firewall in a computer system. SUMMARY

[0006] Various embodiments of the present disclosure set forth a computer-implemented method for processing a first transaction via an interconnect. The method includes determining that the first transaction is directed to a firewall. The method also includes aborting execution of the first transaction. The method further includes modifying a memory address included in the first transaction and in a first memory address format to generate a modified memory address in a second memory address format. The method also includes transmitting the first transaction including the modified memory address to the firewall via the interconnect.

[0007] Other embodiments include, without limitation, systems implementing one or more aspects of the disclosed technology, and one or more computer-readable media comprising instructions for executing one or more aspects of the disclosed technology, and methods for executing one or more aspects of the disclosed technology.

[0008] At least one technical advantage of the disclosed technology over the prior art is that with the disclosed technology, the firewall is distributed such that each initiator is associated with a separate initiator firewall and each target is associated with a target firewall. Each transaction is routed directly from the initiator firewall associated with the initiator to the target firewall associated with the target along a path. Because the transactions are not routed through a centralized firewall, the transactions are processed more efficiently relative to prior approaches. These advantages represent one or more technical improvements over prior art approaches. BRIEF DESCRIPTION OF DRAWINGS

[0009] So that the manner in which the above recited features of the various embodiments are set forth in a more detailed understanding, a more detailed description of the inventive concepts briefly set forth above can be had by reference to one of the various embodiments, some of which are illustrated in the attached drawings. It is to be noted, however, that the appended drawings illustrate only typical embodiments of this inventive concept and are therefore not to be considered limiting of its scope, as the inventive concept can admit to other equally effective embodiments.

[0010] Figure 1 is a block diagram of a computer system configured to implement one or more aspects of the various embodiments;

[0011] Figure 2 is a block diagram of a firewall system for a computer system in accordance with various embodiments Figure 1

[0012] Figure 3A is a block diagram of a firewall system in accordance with various embodiments having a centralized firewall for a computer system Figure 1

[0013] Figure 3B is a block diagram of a firewall system in accordance with various embodiments having a distributed firewall for a computer system Figure 1

[0014] Figures 4A-4B shows a flow diagram of method steps for processing transactions via an interconnect and distributed firewall in accordance with various embodiments Figure 3B DETAILED DESCRIPTION

[0015] In the following description, numerous specific details are set forth to provide a more thorough understanding of the various embodiments. However, it will be apparent to one skilled in the art that the present inventive concepts can be practiced without one or more of these specific details.

[0016] System Overview

[0017] Figure 1 is a block diagram of a computer system 100 configured to implement one or more aspects of the various embodiments. As shown, the computer system 100 includes, without limitation, a central processing unit (CPU) 102 and system memory 104 coupled to a parallel processing subsystem 112 via a memory bridge 105 and a communication path 113. The memory bridge 105 is further coupled to an I / O (input / output) bridge 107 via a communication path 106, and the I / O bridge 107 is in turn coupled to a switch 116.

[0018] In operation, the I / O bridge 107 is configured to receive user input information from an input device 108, such as a keyboard or mouse, and to forward this input information to the CPU 102 via the communication path 106 and the memory bridge 105 for processing. The switch 116 is configured to provide connectivity between the I / O bridge 107 and other components of the computer system 100, such as a network adapter 118 and various additional cards 120 and 121.

[0019] ​​​​Also as shown, the I / O bridge 107 is coupled to a system disk 114, which can be configured to store content and applications and data used by the CPU 102 and the parallel processing subsystem 112. In general, the system disk 114 provides non-volatile storage for applications and data and can include a fixed or removable hard disk drive, flash memory device, and CD-ROM (compact disk read only memory), DVD-ROM (digital versatile disk-ROM), Blu-ray, HD-DVD (high definition DVD), or other magnetic, optical, or solid state storage devices. Finally, while not explicitly shown, other components such as universal serial bus or other port connections, compact disk drives, digital versatile disk drives, tape storage devices, etc. can also be connected to the I / O bridge 107.

[0020] In various embodiments, the memory bridge 105 can be a northbridge chip and the I / O bridge 107 can be a southbridge chip. Further, the communication paths 106 and 113 and other communication paths within the computer system 100 can be implemented using any technically suitable protocol, including but not limited to AGP (accelerated graphics port), HyperTransport, or any other bus or point-to-point communication protocol known in the art.

[0021] In some embodiments, the parallel processing subsystem 112 includes a graphics subsystem that delivers pixels to a display device 110, which can be any conventional cathode ray tube, liquid crystal display, light emitting diode display, or the like. In such embodiments, the parallel processing subsystem 112 incorporates circuitry optimized for graphics and video processing, including, for example, video output circuitry. This circuitry can be incorporated across one or more parallel processing units (PPUs) included within the parallel processing subsystem 112. In other embodiments, the parallel processing subsystem 112 incorporates circuitry optimized for general purpose and / or compute processing. Again, such circuitry can be incorporated across one or more PPUs included within the parallel processing subsystem 112 that are configured to perform such general purpose and / or compute operations. In still other embodiments, one or more PPUs included within the parallel processing subsystem 112 can be configured to perform graphics processing, general purpose processing, and compute processing operations. The system memory 104 includes at least one device driver 103 configured to manage processing operations of the one or more PPUs within the parallel processing subsystem 112.

[0022] In various embodiments, the parallel processing subsystem 112 can be integrated with Figure 1 one or more other elements to form a single system. For example, the parallel processing subsystem 112 can be integrated with the CPU 102 and other connectivity circuitry on a single chip to form a system on a chip (SoC).

[0023] It will be appreciated that the system shown herein is illustrative and variations and modifications are possible. The connection topology, including the number and arrangement of bridges, the number of CPUs 102, and the number of parallel processing subsystems 112, can be modified as desired. For example, in some embodiments, system memory 104 can be connected directly to the CPUs 102 instead of through the memory bridge 105, and other devices would communicate with system memory 104 via the memory bridge 105 and the CPUs 102. In other alternative topologies, the parallel processing subsystem 112 can be connected to the I / O bridge 107 or directly to the CPUs 102, instead of to the memory bridge 105. In yet other embodiments, the I / O bridge 107 and the memory bridge 105 can be integrated into a single chip, rather than existing as one or more discrete devices. Finally, in certain embodiments, one or more of the components illustrated in FIG. 1 can not be present. For example, the Figure 1 switch 116 can be eliminated, and the network adapters 118 and additional cards 120, 121 would connect directly to the I / O bridge 107.

[0024] Physical distributed control plane firewall with unified software view

[0025] Various embodiments include techniques for processing transactions via computer systems interconnected with a distributed firewall. With the disclosed techniques, the firewall is distributed among initiators and targets in a computer system interconnect. Firewalls with initiator affinity are placed closer to the corresponding initiators. These firewalls, referred to as initiator firewalls, restrict transactions from the corresponding initiators to a specified and limited address range. Firewalls with target affinity are placed closer to the corresponding targets. Target firewalls restrict transactions to only allow transactions from initiators authorized to access the corresponding target. Generally, one of the initiators is responsible for configuring the initiator firewalls and the target firewalls. Prior to configuration, the initiator firewalls and the target firewalls are transparent, passing all transactions through. After the initiator firewalls and the target firewalls are configured, the initiator firewalls and the target firewalls can detect and authorize or block access from other initiators.

[0026] In addition, a firewall remapper performs the mapping function during the initialization and configuration process of the initiator firewalls and the target firewalls. The firewall remapper facilitates the programming and configuration of the initiator firewalls and the target firewalls. The firewall remapper maps the various initiator firewalls and target firewalls in the computer system interconnect to a single unified view. The unified view merges the memory address spaces of the various initiator firewalls and target firewalls into a single address space that includes the memory address spaces of all the initiator firewalls and target firewalls. As a result, the initiators do not need to manage separate address spaces for each of the initiator firewalls and target firewalls, but instead access all the firewalls from a software perspective via the unified view.

[0027] Figure 2 is a block diagram of a firewall system 200 of a computer system 100 in accordance with various embodiments Figure 1 A block diagram of a firewall system 200 of a computer system 100 in accordance with various embodiments. As shown, the firewall system 200 includes, without limitation, an initiator 210 and a target 220 in communication with each other via an interconnect 230. The interconnect 230 is also referred to herein as a “mesh network.” The initiator 210 includes, without limitation, a CPU complex 242, a boot processor 244, a power management processor 246, a camera processor 248, a security processor 250, and a debug processor 252. The target includes, without limitation, a PCIe target 260 and a peripheral bus target 262.

[0028] The CPU complex 242 includes one or more central processing units, such as Figure 1 CPU 102 of FIG. 1. In some embodiments, the CPU complex 242 can also include one or more parallel processors, such as Figure 1 parallel processing subsystem 112 of FIG. 1. In operation, the CPUs 102, parallel processing subsystem 112, and / or other processors included in the CPU complex 242 execute operating systems, user-level applications, and / or other executable software applications.

[0029] In operation, the boot processor 244 executes a boot sequence that includes functions for initializing the various functions of the firewall system 200 upon power up and / or reset of the firewall system 200. The boot sequence performed by the boot processor 244 can include functions for initializing memory, configuring the various targets 220, loading and executing one or more operating systems and / or hypervisors, and / or the like. Upon completion of the boot sequence, the boot processor 244 can notify the CPUs 102, parallel processing subsystem 112, and / or other processors included in the CPU complex 242 that the boot sequence is complete, and can begin execution of applications.

[0030] The power management processor 246 monitors the activities of the other components of the firewall system 200. The power management processor 246 controls various power gate control signals that are configured to provide or remove power to the various components of the firewall system 200. If a particular component (whether the initiator 210 or the target 220) remains idle for a period of time, the power management processor 246 changes the level of the corresponding power gate control signal in order to remove power to the particular component. In response, the component transitions from a powered up state to a powered down state. Subsequently, if the power management processor 246 determines that a component in the powered down state is needed to support operations within the firewall system 200, the power management processor 246 changes the level of the corresponding power gate control signal in order to apply power to the particular component. In response, the component transitions from the powered down state to the powered up state. Additionally or alternatively, the power management processor 246 can provide control signals to gate or remove clock signals for various idle components to reduce power consumption. In this way, the power management processor 246 reduces the power consumption of the firewall system 200 when one or more components are idle.

[0031] The camera processor 248 receives image data from still image cameras and / or video cameras (not shown). In general, image data can be large in size and can involve a significant amount of pre-processing. Accordingly, the firewall system 200 includes a separate camera processor 248 that retrieves and processes this image data. As a result, the CPUs 102 included in the CPU complex 242, the parallel processing subsystem 112, and / or other processors are freed up to perform other tasks.

[0032] The security processor 250 performs various security functions to detect malware, software viruses, memory leaks, and otherwise exhibit suspicious behavior of applications. The security processor 250 isolates such applications and / or the processors that execute these applications in order to mitigate any damage that can be caused by the applications.

[0033] The debug processor 252 supports software development by providing debugging and tracing functionality for the CPUs 102 included in the CPU complex 242, the parallel processing subsystem 112, and / or other processors. The debug processor 252 can set traps to stop execution of an application under certain conditions or when a breakpoint placed in the application is detected. The debug processor 252 can generate traces that include the state of the processor executing the application. The debug processor 252 can allow a software developer to modify the state of the processor before resuming execution. The debug processor can further allow an application to execute one instruction at a time and then stop after each instruction. These functions enable a software developer to monitor the behavior of an application and facilitate debugging of the application.

[0034] CPU complex 242, boot processor 244, power management processor 246, camera processor 248, security processor 250, debug processor 252, and / or other initiators 210 communicate with various targets 220 via interconnect 230. The targets include PCIe target 260 and peripheral bus target 262.

[0035] PCIe target 260 includes components of firewall system 200 that communicate with initiators 210 via the Peripheral Component Interconnect Express (PCIe) bus standard. PCIe target 260 can include, but is not limited to, a secondary graphics processor, an audio / sound processor, a display processor, etc.

[0036] Peripheral bus target 262 includes components of firewall system 200 that communicate with initiators 210 via any technically feasible communication channel other than the PCIe bus standard. Peripheral bus target 262 can include, but is not limited to, a memory system, a Universal Asynchronous Receiver / Transmitter (UART), a Serial Peripheral Interface (SPI), an Ethernet controller, etc.

[0037] To provide security isolation across applications executing on various initiators 210 and to mitigate interference from one application to other applications, firewall system 200 can implement firewall 232. Firewall 232 acts as a security system that monitors and controls incoming and outgoing transactions across interconnect 230 to ensure that each initiator 210 accesses only memory address spaces and / or other targets 220 that the initiator 210 is allowed to access. Firewall 232 is deployed within interconnect 230 so as to avoid dependencies and / or interference from initiators, such as interference due to power gating, clock gating, and reset cycles. Thus, firewall 232 authorizes transactions regardless of how various initiators 210 are active. Generally, firewall 232 is reset when needed by a secure reset signal that is inaccessible to non-secure applications executing on initiators 210.

[0038] Figure 3A is a block diagram of a firewall system 300 according to various embodiments, the firewall system having a centralized firewall for Figure 1 computer system 100. As shown, firewall system 300 includes, but is not limited to, initiators 302 and targets 304 that communicate with each other via interconnect 310. Interconnect 310 is also referred to herein as a "mesh network." Interconnect 310 includes, but is not limited to, node (A) 306 and centralized firewall 308.

[0039] Some of the nodes A 306 in the interconnect 310 are associated with the initiators 302 but not with the targets 304. For example, nodes A(0,1) 306(1), A(0,2) 306(2), and A(0,3) 306(3) are associated with initiator (0,1) 302(1), initiator (0,2) 302(2), and initiator (0,3) 302(3), respectively. Similarly, nodes A(3,1) 306(1), A(3,2) 306(2), and A(3,3) 306(1) are associated with initiator (3,1) 302(6), initiator (3,2) 302(7), and initiator (3,3) 302(8), respectively. Some of the nodes A 306 in the interconnect 310 are associated with the targets 304 but not with the initiators 302. For example, nodes A(1,0) 306(5) and A(2,0) 306(10) are associated with target (1,0) 304(1) and target (2,0) 304(2), respectively. Similarly, nodes A(1,4) 306(9) and A(2,4) 306(14) are associated with target (1,4) 304(5) and target (2,4) 304(6), respectively.

[0040] Some of the nodes A 306 in the interconnect 310 are associated with both the initiators 302 and the targets 304. For example, node A(0,0) 306(0) is associated with both initiator (0,0) 302(0) and target (0,0) 304(0). Node A(0,4) 306(4) is associated with initiator (0,4) 302(4) and target (0,4) 304(4). Node A(3,0) 306(15) is associated with initiator (3,0) 302(5) and target (3,0) 304(3). Node A(3,4) 306(19) is associated with initiator (3,4) 302(9) and target (3,4) 304(7). Some of the nodes A 306 in the interconnect 310 are interconnected with other nodes 306 and / or the centralized firewall 308 but are not directly associated with any initiator 302 or target 304. For example, nodes A(1,1) 306(6), A(1,3) 306(8), A(2,1) 306(11), A(2,2) 306(12), and A(2,3) 306(13) are interconnected with other nodes 306 but are not directly associated with any initiator 302 or target 304.

[0041] To provide security isolation across applications executing on the various initiators 302 and to mitigate interference from one application to others, all transactions handled by the firewall system 300 pass through the centralized firewall 308. In effect, all transactions are transmitted by the various initiators 302 and are merged at the centralized firewall 308. For each transaction, the centralized firewall 308 performs an authorization function to determine whether the initiator 302 is authorized to access the target 304 specified by the transaction. If the centralized firewall 308 determines that the initiator 302 is not authorized to direct the transaction to the memory address space associated with the target 304, the centralized firewall 308 blocks the transaction. On the other hand, if the centralized firewall 308 determines that the initiator 302 is authorized to direct the transaction to the memory address space associated with the target 304, the centralized firewall 308 allows the transaction to proceed. Transactions authorized by the centralized firewall 308 are separated at the output of the centralized firewall 308 and proceed to the corresponding target 304.

[0042] While specific initiators 302 can generate transactions for various targets 304 scattered throughout the firewall system 300, the centralized firewall 308 presents a uniform software view of the firewall for the targets to the initiators 302 in the form of a single address space, independent of the number of firewalls for the various targets 304 or the structure and / or topology of the interconnect 310. With the uniform software view, the initiators 302 address the firewall for a given target 304 by adding an offset associated with the firewall for the target 304 to a single firewall base address. For example, to address the firewall for target (0,0) 304(0), the initiator 302 directs a transaction to the firewall base address + target firewall offset (0,0). Similarly, to address the firewall for target (2,1) 304(11), the initiator 302 directs a transaction to the firewall base address + target firewall offset (2,1), and so on.

[0043] In general, one of the initiators is responsible for configuring the firewalls for the targets via the uniform software view of the firewall. Prior to configuration, the firewalls are transparent, passing all transactions through. After the firewalls are configured, the firewalls can detect and authorize or block access from other initiators.

[0044] In one particular example, an initiator (0,0) 302(0) performs a transaction directed to a target (0,0) 304(0). Even though the initiator (0,0) 302(0) and the target (0,0) 304(0) are both associated with the same node A(0,0) 306(0), the transaction is not allowed to pass directly from the initiator (0,0) 302(0) to the target (0,0) 304(0) via the node A(0,0) 306(0). The transaction travels from the initiator (0,0) 302(0) to the centralized firewall 308 along path 330. In doing so, the transaction travels through the nodes A(0,0) 306(0), A(0,1) 306(1), A(0,2) 306(2), and A(1,2) 306(7) before reaching the centralized firewall 308. The centralized firewall 308 performs an authorization function to determine whether the initiator (0,0) 302(0) is authorized to access the memory address space associated with the target (0,0) 304(0) specified by the transaction. If the centralized firewall 308 determines that the initiator (0,0) 302(0) is not authorized to direct the transaction to the memory address space associated with the target (0,0) 304(0), then the centralized firewall 308 blocks the transaction. On the other hand, if the centralized firewall 308 determines that the initiator (0,0) 302(0) is authorized to direct the transaction to the memory address space associated with the target (0,0) 304(0), then the centralized firewall 308 allows the transaction to travel from the centralized firewall 308 to the target (0,0) 304(0) along path 332. In doing so, the transaction travels through the nodes A(1,2) 306(7), A(1,1) 306(6), A(1,0) 306(5), and A(0,0) 306(0) before reaching the target (0,0) 304(0).

[0045] The above approach is reasonably efficient for small interconnects 310. However, for various reasons, the approach does not scale well for larger interconnects 310. First, all transactions passing through the interconnect 310 are consolidated into the centralized firewall 308 and then separated after being authorized by the centralized firewall 308. Thus, a large amount of bandwidth of the interconnect 310 is consumed by transmitting transactions from the initiators 302 to the centralized firewall 308 and from the centralized firewall 308 to the targets 304. Second, transmitting transactions from the initiators 302 to the targets 304 via the centralized firewall 308, such as via path 330 and path 332, increases the latency of the transactions relative to transmitting the transactions directly from the initiators 302 to the targets 304. This increased latency results in decreased performance of the interconnect 310. Third, because all transactions pass through the centralized firewall 308, the utilization of the centralized firewall 308 can become very high, creating hot spots in that area from a temperature and power consumption perspective. Fourth, because all transactions are routed to and from the centralized firewall 308, the area around the centralized firewall 308 can have a high wire count, which in turn can cause congestion and routing difficulties during layout. Fifth, the centralized firewall 308 can have difficulty meeting timing requirements because the centralized firewall 308 includes a firewall for all initiators 302 and targets 304. Thus, the interconnect 310 with the centralized firewall 308 is more suitable for relatively small firewall systems 300.

[0046] Figure 3B is a firewall system 350 with a distributed firewall for a computer system 100 according to various embodiments. Figure 1 A block diagram of the firewall system 350 of the distributed firewall of the computer system 100. As shown, the firewall system 350 includes, without limitation, an initiator 302, a target 304, an initiator firewall 312, and a target firewall 314 in communication with each other via an interconnect 320. The interconnect 320 is also referred to herein as a "mesh network." The interconnect 320 includes, without limitation, a node (A) 306, a firewall trap 322, and a firewall remapper 324. Figure 3B The functions of the initiator 302, the target 304, and the node 306 of the firewall system 350 are similar to the initiator 302, the target 304, and the node 306 of the firewall system 300 of Figure 3A except as further described below.

[0047] With the firewall system 350, the firewall trap 322 and the firewall remapper 324 are utilized. Figure 3BFirewall system 350, the firewalls are distributed through firewall system 350, rather than being centralized within interconnect 320. Firewalls with initiator affinity are referred to as initiator firewalls (IFWs) 312. An initiator firewall 312 is placed in proximity to a corresponding initiator 302 and is used to restrict or sandbox each corresponding initiator 302 to address a limited address range. In some embodiments, multiple initiator firewalls 312 can be consolidated and placed at a common node 306 in order to sandbox multiple initiators 302.

[0048] Each initiator 302 of firewall system 350 is connected to a respective node 306 via a corresponding initiator firewall (IFW) 312. Initiator (0,0) 302(0), initiator (0,1) 302(1), initiator (0,2) 302(2), initiator (0,3) 302(3), and initiator (0,4) 302(4) are connected to node A(0,0) 306(0), A(0,1) 306(1), A(0,2) 306(2), A(0,3) 306(3), and A(0,4) 306(4) via IFW(0,0) 312(0), IFW(0,1) 312(1), IFW(0,2) 312(2), IFW(0,3) 312(3), and IFW(0,4) 312(4), respectively. Similarly, initiator (3,0) 302(5), initiator (3,1) 302(6), initiator (3,2) 302(7), initiator (3,3) 302(8), and initiator (3,4) 302(9) are connected to node A(3,0) 306(15), A(3,1) 306(16), A(3,2) 306(17), A(3,3) 306(18), and A(3,4) 306(19) via IFW(3,0) 312(5), IFW(3,1) 312(6), IFW(3,2) 312(7), IFW(3,3) 312(8), and IFW(3,4) 312(9), respectively.

[0049] Firewalls with target affinity are referred to as target firewalls (TFWs) 314. A target firewall 314 is placed in proximity to a corresponding target 304 that is protected by the respective target firewall 314. In some embodiments, a target firewall 314 can protect multiple targets by implementing a firewall for each of the multiple targets protected by the target firewall 314. In such embodiments, the target firewall 314 scales to the number of targets 304 associated with the corresponding node 306 and the individual functionality of each target 304.

[0050] Each target 304 of the firewall system 350 is connected to the corresponding node 306 via the corresponding target firewall (TFW) 314. Targets (0,0)304(0), (1,0)304(1), (2,0)304(2), and (3,0)304(3) are connected to nodes A(0,0)306(0), A(1,0)306(5), A(2,0)306(10), and A(3,0)306(3) via TFW(0,0)314(0), TFW(1,0)314(1), TFW(2,0)314(2), and TFW(3,0)314(3), respectively. Similarly, targets (0,4)304(4), (1,4)304(5), (2,4)304(6), and (3,4)304(7) are connected to nodes A(0,4)306(4), A(1,4)306(9), A(2,4)306(14), and A(3,4)306(19) via TFW(0,4)314(4), TFW(1,4)314(5), TFW(2,4)314(6), and TFW(3,4)314(7), respectively.

[0051] In a specific example, initiator (0,0)302(0) executes a transaction targeting target (0,0)304(0). The IFW(0,0)312(0) of initiator (0,0)302(0) performs an authorization function to determine whether initiator (0,0)302(0) is authorized to access target (0,0)304(0) specified by the transaction. In doing so, the IFW(0,0)312(0) of initiator (0,0)302(0) checks the memory address specified by the transaction. The IFW(0,0)312(0) determines whether initiator (0,0)302(0) is authorized to direct the transaction to the memory address space that includes the memory address specified by the transaction. If the IFW(0,0)312(0) determines that initiator (0,0)302(0) is not authorized to direct the transaction to the memory address space, the IFW(0,0)312(0) blocks the transaction. On the other hand, if IFW(0,0)312(0) determines that the initiator (0,0)302(0) is authorized to point the transaction to the memory address space, then IFW(0,0)312(0) allows the transaction to continue.

[0052] The transaction is transmitted directly from the IFW(0,0)312(0) of the originator (0,0)302(0) to the TFW(0,0)314(0) of the target (0,0)304(0) via node 306. The transaction follows the shortest path from the IFW(0,0)312(0) of the originator (0,0)302(0) to the TFW(0,0)314(0) of the target (0,0)304(0). The shortest path can be determined using any technically feasible technique, such as Manhattan distance, Euclidean distance, etc. As shown in the figure, the transaction travels along path 340 from IFW(0,0)312(0) through node A(0,0)306(0) and then to TFW(0,0)314(0).

[0053] TFW(0,0)314(0) performs an authorization function to determine whether the initiator (0,0)302(0) is authorized to direct the transaction to the target (0,0)304(0) protected by TFW(0,0)314(0). If TFW(0,0)314(0) determines that the initiator (0,0)302(0) is not authorized to direct the transaction to the target (0,0)304(0), then TFW(0,0)314(0) blocks the transaction. On the other hand, if TFW(0,0)314(0) determines that the initiator (0,0)302(0) is authorized to direct the transaction to the target (0,0)304(0), then TFW(0,0)314(0) allows the transaction to proceed. TFW(0,0)314(0) forwards the transaction to the target (0,0)304(0) for processing.

[0054] Using a distributed firewall, the firewall system 350 is not located in a centralized firewall (such as...). Figure 3A The firewall system 300 merges and separates transactions at the centralized firewall 308. Therefore, the firewall system 350 does not experience bottlenecks or combinations at a single firewall. Figure 3A The description addresses latency, hotspots, and congestion issues. Each transaction traverses the shortest path from the relevant IFW 312 to the relevant TFW 314. Furthermore, each TFW 314 includes only firewalls for the specific target 304 protected by that TFW 314. Therefore, combined with... Figure 3A The described timing issues have been reduced and / or eliminated.

[0055] Using this method for distributed firewalls, the initiating firewall 312 authorizes transactions originating from the associated initiator 302. If the transaction is authorized, the initiating firewall 312 transmits the transaction to the target firewall 314 via the shortest path through the interconnect 320, through node 306 of the interconnect 320, without passing through the centralized firewall. The target firewall 314 authorizes the transaction for the associated target 304. If the transaction is authorized, the target firewall 314 forwards the transaction to the associated target 304.

[0056] While this approach works well for transactions targeting the majority of objects, it presents challenges for transactions where the target is one or more of the initiating firewall 312 or the target firewall 314 itself, for example, when the boot processor 244 initializes and configures the initiating firewall 312 and the target firewall 314. During initialization, Figure 2 The boot processor 244 or a similar processor configures the initiator firewall 312 using the memory address space authorized by the associated initiator 302. Similarly, the boot processor 244 configures the target firewall 314 using a list of initiators 302 authorized to transmit transactions to the target 304 protected by the associated target firewall 314.

[0057] Utilizing distributed target firewalls 314, the boot processor 244 directs transactions to different individual initiating firewalls 312 and target firewalls 314, each associated with a separate address space. Therefore, a unified software view is not presented to the boot processor 244 as a single address space encompassing the memory address space for all initiating firewalls 312 and target firewalls 314. Instead, the boot processor 244 addresses a given initiating firewall 312 or target firewall 314 by adding the offset associated with that firewall to its base address. Furthermore, as the number and address space size of the individual initiating firewalls 312 and target firewalls 314 change, the base address of each initiating firewall 312 or target firewall 314 can change with each iteration of the firewall system 350. For example, to address target firewall (0,0) 314 (0), boot processor 244 directs the transaction to the target firewall's (0,0) base address + target firewall offset (0,0). Similarly, to address target firewall (2,1) 304 (11), boot processor 244 directs the transaction to the target firewall's (2,1) base address + target firewall offset (2,1), and so on. To directly address the distributed initiating firewalls 312 and target firewalls 314, boot processor 244 will have to maintain a list of base addresses for various initiating firewalls 312 and target firewalls 314. Furthermore, the number and address space size of initiating firewalls 312 and target firewalls 314 change with the iteration of firewall system 350.

[0058] To mitigate this problem, firewall system 350 includes firewall catcher 322 and firewall remapping unit 324. Boot processor 244 addresses the individual registers of initiating firewall 312 and target firewall 314 using a unified software view, as if initiating firewall 312 and target firewall 314 had a common base address. The memory addresses generated by boot processor 244 address the registers in the initiating firewall address space and target firewall address space as offsets from a single firewall base address. This form of address is called an initiating-based address.

[0059] Firewall catcher 322 captures software-initiated transactions targeting initiating firewall 312 and target firewall 314, and forwards the access to the correct initiating firewall address space or target firewall address space. In doing so, firewall catcher 322 temporarily suspends the execution of the transaction. Transactions specifying initiating addresses cannot be directly sent to initiating firewall 312 or target firewall 314 until the memory address is remapped to an address specifying an offset from the base address of the relevant target address space. This form of address is called a target-based address. Firewall catcher 322 captures transactions awaiting remapping. Firewall catcher 322 directs the transaction to firewall remapper 324 included in interconnect 320.

[0060] Firewall remapping 324 remaps memory addresses included in a transaction by changing the memory addresses from initiator-based addresses to destination-based addresses. Firewall remapping 324 maintains a lookup table, called the remapping table, which maps the base addresses of the memory address spaces of each initiator firewall 312 and destination firewall 314 to a single address space with a single base address, and vice versa. After firewall remapping 324 remaps the initiator-based addresses, the remapped addresses are now in the form of destination-based addresses.

[0061] The remapping table is hard-coded in the firewall remapping unit 324 and can be changed with each iteration of the firewall system 350. However, these changes are transparent to the boot processor 244 and other initiators 302. As a result, the boot processor 244 and other initiators 302 can use the same base address to reference the respective initiator firewall 312 and the target firewall 314, even with iterations of the firewall system 350.

[0062] For example, to address the target firewall (0,0) 314 (0), boot processor 244 directs the transaction to the firewall base address + target firewall offset (0,0). Firewall remainder 324 remaps this address to an address specified as an offset from the base address used for the target firewall 314, such as target firewall (0,0) base address + target firewall offset (0,0). Similarly, to address the target firewall (2,1) 314 (11), boot processor 244 directs the transaction to the firewall base address + target firewall offset (2,1). Firewall remainder 324 remaps this address to an address specified as an offset from the base address used for the target firewall 314, such as target firewall (2,1) base address + target firewall offset (2,1). Firewall remainder 324 similarly remaps the address for transactions targeting the initiating firewall 312.

[0063] After firewall remapping unit 324 remaps the memory addresses included in a transaction by changing the memory addresses from initiator-based addresses to destination-based addresses, the transaction can now be processed to configure the associated initiator firewall 312 or destination firewall 314. Therefore, firewall catcher 322 forwards the transaction to the address space associated with the modified memory address, thereby allowing the transaction to proceed.

[0064] Although the firewall remapping mechanism 324 may introduce some additional traffic into the firewall system 350, most of this additional traffic occurs only once during boot when the boot processor 244 configures the initiating firewall 312 and the target firewall 314. Therefore, after configuring the initiating firewall 312 and the target firewall 314, the firewall remapping mechanism 324 introduces little or no impact on the performance of the firewall system 350 during runtime. Furthermore, the traffic on the firewall system 350 used to configure the initiating firewall 312 and the target firewall 314 is only transmitted to the relevant initiating firewall 312 and the target firewall 314, not all initiating firewalls 312 and the target firewall 314. As a result, the configuration of the initiating firewall 312 and the target firewall 314 introduces little or no unnecessary traffic into the firewall system 350.

[0065] Will realize, Figures 2-3B The interconnections shown are illustrative and variations and modifications are possible. In one example, Figures 2-3B The interconnection is shown as having a specific number of nodes, initiators, and targets. However, within the scope of this disclosure, the interconnection can have any technically feasible number of nodes, initiators, and targets. In another example, in Figures 2-3B In the interconnection, some nodes are associated with the initiating firewall, some with the target firewall, some with both the initiating and target firewalls, and some are not associated with either the initiating or target firewall. However, within the scope of this disclosure, any node in the interconnection may be associated with the initiating firewall, the target firewall, or both. In yet another example, Figures 3A-3B The interconnected nodes are shown as having some connection to each other and / or to a firewall. However, within the scope of this disclosure, nodes may be interconnected to each other and / or to a firewall in any technically feasible manner and via any technically feasible interconnection structure and / or topology. In yet another example, Figure 3B The initiating firewall and the target firewall are shown outside the interconnect 320 of the firewall system 350. However, within the scope of this disclosure, the initiating firewall and the target firewall may be included within the interconnect 320 of the firewall system 350.

[0066] Figures 4A-4B The method for using various embodiments via [the specified method] is explained. Figure 3B A flowchart illustrating the steps involved in handling transactions using interconnected 320 and distributed firewalls. Although combined... Figures 1-3B This disclosure describes the method steps using a system, but those skilled in the art will understand that any system configured to perform the method steps in any order is within the scope of this disclosure.

[0067] As shown in the figure, method 400 begins at step 402, where initiator 302 issues a transaction. Initiator 302 includes any system component capable of initiating transactions (such as load or store operations) targeting a destination. Initiator 302 includes, but is not limited to, CPU complex 242, boot processor 244, power management processor 246, camera processor 248, security processor 250, and debug processor 252. Destination includes, but is not limited to, PCIe destination 260 and peripheral bus destination 262. Initiator 302 executes a transaction directed to destination 304. Generally, initiator 302 directs a transaction (such as a load or store operation) to destination 304 via interconnect 320. In some examples, initiator 302 may perform a load operation to retrieve one or more data values ​​from memory locations and / or registers included in destination 304. Similarly, in some examples, initiator 302 may perform a store operation to store one or more data values ​​into memory locations and / or registers included in destination 304.

[0068] In step 404, the firewall catcher 322 included in the interconnect 320 determines whether the transaction is directed to either the initiating firewall 312 or the target firewall 314. If the firewall catcher 322 determines that the transaction is directed to either the initiating firewall 312 or the target firewall 314, the initiator-based address included in the transaction should be remapped to a target-based address. Although the initiator 302 can generate transactions directed to various targets 304 scattered throughout the firewall system 350, when the initiator 302 generates a transaction directed to either the initiating firewall 312 or the target firewall 314, such as during the initialization and configuration of the initiating firewall 312 and the target firewall 314, the initiator 302 addresses the target address space as an offset from a single firewall base address, independent of the number of targets 304 or the structure and / or topology of the interconnect 310. This form of address is referred to as an initiator-based address. For example, to address the firewall at target (0,0) 304(0), the initiator 302 directs the transaction to the firewall base address + the target firewall offset (0,0). Similarly, in order to address the firewall of target (2,1)304(11), initiator 302 directs the transaction to the firewall base address + target firewall offset (2,1), and so on.

[0069] In this case, method 400 proceeds to step 406, where firewall catcher 322 captures the transaction. In doing so, firewall catcher 322 temporarily suspends the execution of the transaction. Transaction specifying an initiator-based address cannot be directly sent to either the initiator firewall 312 or the target firewall 314 until the memory address is remapped to an address specifying an offset from the base address in the relevant firewall address space. This form of address is called a target-based address. Firewall catcher 322 captures transactions awaiting remapping. In step 408, firewall catcher 322 directs the transaction to firewall remapper 324 included in interconnect 320.

[0070] In step 410, firewall remapping 324 remaps the memory addresses included in the transaction by changing the memory addresses from initiator-based addresses to target-based addresses. Firewall remapping 324 maintains a lookup table, called the remapping table, which maps the base addresses of the memory address spaces of each initiator firewall 312 and target firewall 314 to a single address space with a single base address, and vice versa. In this way, initiator 302 addresses each initiator firewall 312 and target firewall 314 with a unified software view as if they shared a common base address. The memory address generated by initiator 302 addresses the target address space as an offset from the single firewall base address. This form of address is called an initiator-based address. After firewall remapping 324 remaps the initiator-based address, the remapped address now addresses the target address space as an offset from the base address of the relevant target address space. This form of address is called a target-based address.

[0071] The remapping table is hard-coded in the firewall remapping unit 324 and can change with each iteration of the firewall system 350. However, these changes are transparent to the initiator 302. As a result, the initiator 302 can use the same base address to reference different initiating firewalls 312 and target firewalls 314, even with iterations of the firewall system 350.

[0072] For example, to address the firewall at target (0,0)304(0), initiator 302 directs the transaction to the firewall base address + target firewall offset (0,0). Firewall remainder 324 remaps this address to an address specified as an offset from the base address of target firewall 314, such as target (0,0) base address + target firewall offset (0,0). Similarly, to address the firewall at target (2,1)304(11), initiator 302 directs the transaction to the firewall base address + target firewall offset (2,1). Firewall remainder 324 remaps this address to an address specified as an offset from the base address of target firewall 314, such as target (2,1) base address + target firewall offset (2,1). Firewall remainder 324 similarly remaps the address for transactions targeting initiator firewall 312.

[0073] In step 412, firewall catcher 322 forwards the transaction to the address space associated with the modified memory address. After firewall remapping 324 remaps the memory address included in the transaction by changing the memory address from an initiator-based address to a destination-based address, the transaction can now be processed by the relevant initiator firewall 312 or destination firewall 314. Therefore, firewall catcher 322 forwards the transaction to the address space associated with the modified memory address, thereby allowing the transaction to proceed.

[0074] In step 414, interconnect 320 transmits the transaction to either the initiating firewall 312 or the target firewall 314 included in firewall system 350 corresponding to the transaction. Interconnect 320 transmission now includes the target address-based transaction mapped by firewall remapper 324 in step 408. Interconnect 320 sends the transaction from firewall remapper 324 to target firewall 314 of target 304 via node 306 of interconnect 320.

[0075] In step 416, initiator 302 completes the transaction. Method 400 then terminates. Alternatively, method 400 proceeds to step 402 to process additional transactions.

[0076] Returning to step 404, if firewall catcher 322 determines that the transaction does not point to a firewall, then firewall catcher 322 does not catch the transaction. Instead, method 400 proceeds to step 418, where the initiating firewall 312 included in firewall system 350 authorizes the transaction initiated by initiator 302. Initiating firewall 312 then authorizes the transaction. The firewall with initiator affinity is referred to as initiating firewall 312. Initiating firewall 312 is placed near the corresponding initiator 302 and is used to restrict or sandbox each corresponding initiator 302 to address a limited range of addresses. In some embodiments, multiple initiating firewalls 312 may be merged and placed at a common node 306 in order to sandbox multiple initiators 302.

[0077] The initiator firewall 312 of initiator 302 performs an authorization function to determine whether initiator 302 is authorized to access target 304 specified by the transaction. In doing so, the initiator firewall 312 of initiator 302 checks the memory address specified by the transaction. The initiator firewall 312 determines whether initiator 302 is authorized to direct the transaction to the memory address space including the memory address specified by the transaction. If the initiator firewall 312 determines that initiator 302 is not authorized to direct the transaction to the memory address space, the initiator firewall 312 blocks the transaction. On the other hand, if the initiator firewall 312 determines that initiator 302 is authorized to direct the transaction to the memory address space, the initiator firewall 312 allows the transaction to proceed.

[0078] In step 420, interconnect 320 transmits the transaction to the target firewall 314 corresponding to target 304 included in firewall system 350. Interconnect 320 transmits the transaction directly from initiator firewall 312 of initiator 302 to target firewall 314 of target 304 via node 306 of interconnect 320. The transaction follows the shortest path from initiator firewall 312 of initiator 302 to target firewall 314 of target 304. The shortest path can be determined using any technically feasible technique, such as Manhattan distance technique, Euclidean distance technique, etc.

[0079] In step 422, the target firewall 314 authorizes the transaction generated by the initiator 302, as described in conjunction with step 416. A firewall with target affinity is referred to as target firewall 314. Target firewall 314 is placed near the corresponding target 304 protected by the respective target firewall 314. In some embodiments, target firewall 314 can protect multiple targets by implementing a firewall for each of the multiple targets protected by target firewall 314. In such embodiments, target firewall 314 is scaled to the number of targets 304 associated with the corresponding node 306 and the different functionalities of each target 304.

[0080] The target firewall 314 performs an authorization function to determine whether the initiator 302 is authorized to direct the transaction to the target 304 protected by the target firewall 314. If the target firewall 314 determines that the initiator 302 is not authorized to direct the transaction to the target 304, the target firewall 314 blocks the transaction. On the other hand, if the target firewall 314 determines that the initiator 302 is authorized to direct the transaction to the target 304, the target firewall 314 allows the transaction to proceed. The target firewall 314 forwards the transaction to the target 304 for processing. In step 424, the initiator 302 completes the transaction. Method 400 then terminates. Alternatively, method 400 proceeds to step 402 to process additional transactions.

[0081] In summary, the various embodiments include techniques for processing transactions via computer systems interconnected with distributed firewalls. Using the disclosed techniques, firewalls are distributed between initiators and targets in the interconnected computer systems. Firewalls with initiator affinity are placed closer to the corresponding initiator. These firewalls (referred to as initiator firewalls) restrict transactions from the corresponding initiator to a specified and limited address range. Firewalls with target affinity are placed closer to the corresponding target. The target firewall restricts transactions to those from initiators authorized to access the corresponding target. Generally, one of the initiators is responsible for configuring the initiator firewall and the target firewall. Before configuration, the initiator firewall and the target firewall are transparent, allowing all transactions to pass through. After the initiator firewall and the target firewall are configured, the initiator firewall and the target firewall can detect and authorize or block access from other initiators.

[0082] Furthermore, the firewall remapping function performs mapping during the initialization and configuration of the initiating and target firewalls. The firewall remapping function assists in the programming and configuration of the initiating and target firewalls. It maps the individual initiating and target firewalls in the computer system interconnection to a single unified view. This unified view merges the memory address spaces of the individual initiating and target firewalls into a single address space that includes the memory address spaces of all initiating and target firewalls. As a result, the initiator does not need to manage the separate address spaces of each initiating and target firewall, but instead accesses all firewalls from a software perspective via this unified view.

[0083] At least one technical advantage of the disclosed technology over existing technologies is that, using the disclosed technology, firewalls are distributed such that each initiator is associated with a separate initiator firewall and each target is associated with a target firewall. Each transaction is routed directly along the path from the initiator firewall associated with the initiator to the target firewall associated with the target. Because transactions are not routed through a centralized firewall, transactions are handled more efficiently compared to existing methods. Another advantage of the disclosed technology is that transactions are remapped, so that applications executing on the initiator are presented with a unified view of the firewalls, regardless of changes in the specific configuration of the interconnect. Therefore, programmers do not need to modify the application every time the interconnect architecture changes. These advantages represent one or more technical improvements over existing methods.

[0084] Any claim element referenced in any form in any claim and / or any and all combinations of any elements described in this application fall within the intended scope of this disclosure and protection.

[0085] Various embodiments have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments.

[0086] Various aspects of this embodiment can be embodied as systems, methods, or computer program products. Therefore, aspects of this disclosure can take the form of entirely hardware embodiments, entirely software embodiments (including firmware, resident software, microcode, etc.), or embodiments combining software and hardware aspects, all of which are collectively referred to herein as “modules” or “systems.” Furthermore, aspects of this disclosure can take the form of computer program products embodied in one or more computer-readable media having computer-readable program code embodied thereon.

[0087] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media will include the following: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the context of this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0088] The foregoing description of various aspects of this disclosure includes flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, executable by the processor of the computer or other programmable data processing apparatus, perform the functions / actions specified in the flowchart and / or block diagram blocks or blocks. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a dedicated processor, or a field-programmable gate array (FPGA).

[0089] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, including one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative embodiments, the functions indicated in the blocks may not occur in the order shown in the figures. For example, depending on the functions involved, two consecutively shown blocks may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0090] While the foregoing describes embodiments of this disclosure, other and further embodiments of this disclosure may be devised without departing from its essential scope, the scope of which is defined by the following claims.

Claims

1. A computer-implemented method for processing a first transaction via an interconnect comprising a two-dimensional mesh network, the method comprising: receiving the first transaction from an initiator via a first node included in the two-dimensional mesh network; determining that the first transaction is directed to a first firewall; suspending execution of the first transaction; generating a mapping that merges memory address spaces of a plurality of firewalls including the first firewall into a unified memory address space, the unified memory address space having a single firewall base address for all firewalls included in the plurality of firewalls, wherein each firewall included in the plurality of firewalls is addressed by adding the single firewall base address to an offset, the offset being different for each firewall included in the plurality of firewalls; via the mapping, modifying a memory address included in the first transaction and in a first memory address format in a memory address space of the first firewall to generate a modified memory address in a second memory address format in the unified memory address space; and communicating the first transaction including the modified memory address to a target coupled to the first firewall via a second node included in the two-dimensional mesh network.

2. The computer-implemented method of claim 1, wherein: the first firewall comprises an initiator firewall that performs a first authorization function for a second transaction, and a second firewall including a target firewall performs a second authorization function for the second transaction.

3. The computer-implemented method of claim 2, wherein the first authorization function comprises determining that an initiator associated with the initiator firewall is authorized to direct the second transaction to a memory address space including a second memory address included in the second transaction.

4. The computer-implemented method of claim 2, wherein the second authorization function comprises determining whether an initiator associated with the initiator firewall is authorized to direct the second transaction to a target protected by the target firewall. forwarding the first transaction to a firewall remapper after suspending execution of the first transaction.

5. The computer-implemented method of claim 1, further comprising: forwarding the first transaction to an address space associated with the modified memory address after modifying the memory address included in the first transaction to generate the modified memory address.

6. The computer-implemented method of claim 1, further comprising:

7. The computer-implemented method of claim 1, wherein the first firewall comprises an initiator firewall and a target firewall, and the method further comprises: determining a path between an initiator and at least one of the initiator firewall or the target firewall through a plurality of nodes included in the interconnect; and communicating the first transaction from the initiator to the at least one of the initiator firewall or the target firewall via the path.

8. The computer-implemented method of claim 1, wherein the first memory address format comprises: ​ ​ a base address of a firewall address space corresponding to a plurality of address spaces corresponding to a plurality of firewalls including the first firewall; and an offset associated with the first firewall.

9. The computer-implemented method of claim 1, wherein the second memory address format comprises: a base address of a firewall address space corresponding to a first firewall; and an offset associated with the first firewall.

10. The computer-implemented method of claim 1, wherein the first firewall comprises an initiator firewall configured to perform authorization functions of a plurality of initiators.

11. The computer-implemented method of claim 1, wherein the first firewall comprises a target firewall configured to perform authorization functions of a plurality of targets.

12. The computer-implemented method of claim 1, wherein the first firewall comprises an initiator firewall coupled to a first node included in a plurality of nodes within the interconnect, and a second firewall comprises a target firewall coupled to the first node.

13. The computer-implemented method of claim 1, wherein the first firewall comprises an initiator firewall coupled to a first node included in a plurality of nodes within the interconnect, and a second firewall comprises a target firewall coupled to a second node included in the plurality of nodes.

14. A system comprising: an initiator firewall comprising a first microprocessor that executes instructions stored in a first memory; a target firewall comprising a second microprocessor that executes instructions stored in a second memory; a firewall capturer that: receives, via a first node included in a two-dimensional mesh network, a first transaction from an initiator coupled to the initiator firewall; determines that the first transaction is directed to the initiator firewall or the target firewall, and aborts execution of the first transaction; a firewall remapper that: generates a mapping that merges memory address spaces of a plurality of firewalls including the initiator firewall and the target firewall into a unified memory address space having a single firewall base address for all firewalls included in the plurality of firewalls, wherein each firewall included in the plurality of firewalls is addressed by adding the single firewall base address to an offset that is different for each firewall included in the plurality of firewalls; and via the mapping, modifies a memory address included in the first transaction and in a first memory address format in a memory address space of the initiator firewall or the target firewall to generate a modified memory address in a second memory address format in the unified memory address space; and an interconnect comprising the two-dimensional mesh network that transmits, via a second node included in the two-dimensional mesh network, the first transaction including the modified memory address to the initiator coupled to the initiator firewall or a target coupled to the target firewall.

15. The system of claim 14, wherein: the initiator firewall performs a first authorization function on a second transaction, and the target firewall performs a second authorization function on the second transaction.

16. The system of claim 15, wherein the first authorization function comprises determining that an initiator associated with the initiator firewall is authorized to direct the second transaction to a memory address space, the memory address space comprising a second memory address included in the second transaction.

17. The system of claim 15, wherein the second authorization function comprises determining whether an initiator associated with the initiator firewall is authorized to direct the second transaction to a target protected by the target firewall.

18. The system of claim 14, wherein after aborting execution of the first transaction, the firewall sniffer further forwards the first transaction to the firewall remapper.

19. The system of claim 14, wherein after the firewall remapper modifies the memory address included in the first transaction to generate the modified memory address, the firewall sniffer further forwards the first transaction to an address space associated with the modified memory address.

20. The system of claim 14, wherein the system further comprises an initiator associated with the initiator firewall and a target associated with the target firewall, and wherein the interconnect further: determines a path between the initiator and the target through a plurality of nodes included in the interconnect; and transmits a second transaction from the initiator to the target via the path.

Images