Secured cross-address-space bridging

Abstract

A network device includes a bus interface and one or more circuits. The bus interface communicates with a memory using a first bus domain, and with user applications using a second bus domain. The one or more circuits execute a first bus function that accesses a region of the memory using a memory-domain MKEY in the first bus domain, execute a second bus function that communicates with the user applications using the second bus domain, and communicates packets over the network for the user applications, wherein processing of the packets includes accessing the region of the memory via a cross-bus-domain MKEY that points to the memory-domain MKEY in the first bus function, and, in response to authorizing access to a sub-region in the region of the memory, defines for the sub-region a cross-security-domain MKEY pointing to the cross-bus-domain MKEY, which in turn points to the memory-domain MKEY.