System and a method for a remote direct memory access over converged ethernet

• US 9,306,916 B2
• Filed: 12/25/2013
• Issued: 04/05/2016
• Est. Priority Date: 12/25/2013
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Cavium, LLC (Marvell Technology Group Limited)
• Inventors: Snyder, Wilson Parkhurst II
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US14/140,488
• Publication Number:
  US 20150178242A1
• Time in Patent Office: 832 Days
• Field of Search: 713/150
• US Class Current: 1/1
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A method and a system embodying the method for receiving a remote direct memory access packet comprising an opaque data, a virtual address, and a payload at a virtual network interface card that generated the opaque data; reconstructing a stream identifier by separating the opaque data into an encrypted stream identifier and a first digest; decrypting the encrypted stream identifier; verifying the decrypted stream identifier using the first digest; providing the verified stream identifier to a system memory management unit; and mapping the virtual address and the provided stream identifier by the system memory management unit to a physical address, is disclosed.

Claims

1. A method for remote direct memory access, comprising:

generating a remote direct memory access packet comprising an opaque data comprising an encrypted stream identifier and a digest, a virtual address, and a payload at a local machine;

receiving the remote direct memory access packet at a virtual network interface card on the local machine;

reconstructing a stream identifier by separating the opaque data into the encrypted stream identifier and the digest;

decrypting the encrypted stream identifier;

verifying the decrypted stream identifier using the first digest;

providing the verified stream identifier to a system memory management unit; and

mapping the virtual address and the provided stream identifier by the system memory management unit to a physical address, into which to write the payload.

2. The method as claimed in claim 1, wherein providing the verified stream identifier to the system memory management unit comprises:

providing the verified stream identifier to the system memory management unit without any further stream identifier processing.

3. The method as claimed in claim 1, further comprising:

determining a starting page in a memory in accordance with the physical address;

determining an ending page in the memory in accordance with the physical address and size of the payload;

testing each page between the starting page and the ending page, including the starting and the ending page, for access permission; and

writing the payload into the memory if the testing is positive for all the pages.

4. The method as claimed in claim 3, further comprising:

discarding the remote direct memory access packet if the testing is negative for at least one of the pages.

5. The method as claimed in claim 3, wherein the determining an ending page in the memory in accordance with the physical address and size of payload in the remote direct memory access packet comprises:

computing an ending address by adding a size of the payload to the starting address and subtracting number one; and

converting the ending address to the ending page in accordance with the size of a page in the memory.

6. The method as claimed in claim 3, wherein the testing each page comprises:

requesting access to each of the intervening pages in advance of the writing of the payload.

7. An apparatus for remote direct memory access, comprising:

A local machine comprising a virtual network interface card, configured;

to receive a remote direct memory access packet comprising an opaque data comprising an encrypted stream identifier and a digest, a virtual address, and a payload, generated by the local machine,

to reconstruct a stream identifier by separating the opaque data into an encrypted stream identifier and the digest,

to decrypt the encrypted stream identifier;

to verify the decrypted stream identifier using the digest, and

to provide the verified stream identifier to a system memory management unit;

and the system memory management unit communicatively coupled to the virtual network interface card configured to map the virtual address and the stream identifier to a physical address, into which to write the payload.

8. The apparatus as claimed in claim 7, wherein the virtual network interface card is configured to provide the verified stream identifier to the system memory management unit without any further stream identifier processing.

9. The apparatus as claimed in claim 7, wherein the virtual network interface card further configured to

determine a starting page in a memory in accordance with the physical address, and

determine an ending page in the memory in accordance with the physical address and size of the payload;

and

wherein the apparatus further comprises a memory controller communicatively coupled to the system memory management unit, the memory controller being configured to

test each page between the starting page and the ending page, including the starting and the ending page, for access permission; and

write the payload into the memory if the testing is positive for all the pages.

10. The apparatus as claimed in claim 9, wherein the memory controller is further configured to discard the remote direct memory access packet if the testing is negative for at least one of the pages.

11. The apparatus as claimed in claim 9, wherein the memory controller determines an ending page in the memory by being configured to:

compute an ending address by adding a size of the payload to the starting address and subtracting number one; and

convert the ending address to the ending page in accordance with the size of a page in the memory.

12. The apparatus as claimed in claim 9, wherein the memory controller tests each intervening page by being configured to:

request access to each of the pages in advance of the writing of the payload.