Controlling access by a configuration to an adapter function

• US 8,626,970 B2
• Filed: 06/23/2010
• Issued: 01/07/2014
• Est. Priority Date: 06/23/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Craddock, David, Farrell, Mark S., Glendening, Beth A., Gregg, Thomas A., Greiner, Dan F.
• Primary Examiner(s): RHU, KRIS M
• Application Number:
  US12/821,184
• Publication Number:
  US 20110320652A1
• Time in Patent Office: 1,294 Days
• Field of Search: None
• US Class Current: 710/64
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

Access to an input/output adapter by a configuration is controlled. For each requested access to an adapter, checks are made to determine whether the configuration is authorized to access the adapter. If it is not authorized, then access is denied. If it is authorized, but access should be temporarily blocked, then instruction execution is altered to indicate such. If access is permitted, but should be blocked for another reason (other than temporarily), then access is denied.

Claims

1. A computer program product for controlling access to adapters in a computing environment, said computer program product comprising:

a non-transitory computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

executing, by a processor coupled to an adapter, an instruction, the instruction comprising a request by a configuration to access the adapter, the adapter identified by a function handle provided with the request, the executing comprising;

using the function handle to select from a function table a function table entry particular to the adapter specified by the function the function table entry stored in memory associated with the processor and including information associated with the adapter including information to determine whether the configuration is authorized to access the adapter;

determining, by the processor, based on information in the function table entry whether the configuration is authorized to access the adapter, wherein the determining comprises comparing one or more attributes of the configuration requesting access to the adapter to one or more selected attributes of the function table entry to determine whether the configuration has permission to access the adapter; and

allowing access to the adapter, based on determining that the configuration is authorized to access the adapter.

2. The computer program product of claim 1, wherein the method further comprises based on determining that the configuration is not authorized access to the adapter, denying access to the adapter.

3. The computer program product of claim 1, wherein the determining comprises comparing a zone number in the function table entry with a zone number of the configuration, wherein the configuration is authorized access based on the comparing indicating equality.

4. The computer program product of claim 1, wherein the configuration comprises a guest, and wherein the determining comprises checking in the function table entry for an identifier of the guest, wherein the guest is authorized access, based on the identifier being in the function table entry.

5. The computer program product of claim 1, wherein the method further comprises determining whether access is to be blocked for one or more reasons different than authorization checking, the determining using state information of the function table entry, wherein access is allowed based on determining that it is not to be blocked.

6. The computer program product of claim 5, wherein it is determined that access is to be blocked, and said method further comprises:

deciding whether access is to be blocked temporarily; and

providing a busy indicator to the configuration, based on determining that access is to be blocked temporarily.

7. The computer program product of claim 6, wherein the method further comprises denying access, based on deciding access is to be blocked, but not blocked temporarily.

8. The computer program product of claim 1, wherein the method further comprises:

determining a plurality of adapters available to the computing environment; and

creating a function table entry for each adapter of the plurality of adapters.

9. The computer program product of claim 8, wherein the method further comprises:

determining which adapters of the plurality of adapters are accessible to the configuration; and

indicating in the function table entry of each adapter that is accessible to the configuration information regarding the configuration.

10. The computer program product of claim 9, wherein the determining which adapters are accessible to the configuration is based on policy, the policy being reconfigurable.

11. The computer program product of claim 1, wherein the instruction is based on an architecture of the adapter.

12. A computer system for controlling access to adapters in a computing environment, said computer system comprising:

a memory; and

a processor in communications with the memory, wherein the computer system is configured to perform a method, said method comprising;

executing, by a processor coupled to an adapter, an instruction, the instruction comprising a request by a configuration to access the adapter, the adapter identified by a function handle provided with the request, the executing comprising;

using the function handle to select from a function table a function table entry particular to the adapter specified by the function handle, the function table entry stored in memory associated with the processor and including information associated with the adapter including information to determine whether the configuration is authorized to access the adapter;

determining, by the processor, based on information in the function table entry whether the configuration is authorized to access the adapter, wherein the determining comprises comparing one or more attributes of the configuration requesting access to the adapter to one or more selected attributes of the function table entry to determine whether the configuration has permission to access the adapter; and

allowing access to the adapter, based on determining that the configuration is authorized to access the adapter.

13. The computer system of claim 12, wherein the determining comprises comparing a zone number in the function table entry with a zone number of the configuration, wherein the configuration is authorized access based on the comparing indicating equality.

14. The computer system of claim 12, wherein the configuration comprises a guest, and wherein the determining comprises checking in the function table entry for an identifier of the guest, wherein the guest is authorized access, based on the identifier being in the function table entry.

15. The computer system of claim 12, wherein the method further comprises determining whether access is to be blocked for one or more reasons different than authorization checking, the determining using state information of the function table entry, wherein access is allowed based on determining that it is not to be blocked.

16. The computer system of claim 15, wherein it is determined that access is to be blocked, and said method further comprises:

deciding whether access is to be blocked temporarily; and

providing a busy indicator to the configuration, based on determining that access is to be blocked temporarily.

17. The computer system of claim 12, wherein the method further comprises:

determining a plurality of adapters available to the computing environment;

creating a function table entry for each adapter of the plurality of adapters;

determining which adapters of the plurality of adapters are accessible to the configuration; and

indicating in the function table entry of each adapter that is accessible to the configuration information regarding the configuration.

18. The computer system of claim 12, wherein the instruction is based on an architecture of the adapter.

19. A method of controlling access to adapters in a computing environment, said method comprising:

executing, by a processor coupled to an adapter, an instruction, the instruction comprising a request by a configuration to access the adapter, the adapter identified by a function handle provided with the request, the executing comprising;

using the function handle to select from a function table a function table entry particular to the adapter specified by the function handle, the function table entry stored in memory associated with the processor and including information associated with the adapter including information to determine whether the configuration is authorized to access the adapter;

determining, by the processor, based on information in the function table entry whether the configuration is authorized to access the adapter, wherein the determining comprises comparing one or more attributes of the configuration requesting access to the adapter to one or more selected attributes of the function table entry to determine whether the configuration has permission to access the adapter; and

allowing access to the adapter, based on determining that the configuration is authorized to access the adapter.

20. The method of claim 19, wherein the determining comprises comparing a zone number in the function table entry with a zone number of the configuration, wherein the configuration is authorized access based on the comparing indicating equality.

21. The method of claim 19, further comprising determining whether access is to be blocked for one or more reasons different than authorization checking, the determining using state information of the function table entry, wherein access is allowed based on determining that it is not to be blocked.