Graphcore Limited

Microsoft Technology Licensing, LLC

Graham Bernard Cunningham

Daniel John Pelham Wilkinson

Stephen Felix

Daniel Wilkinson

Stavros Volos

Alan Graham Alexander

Richard Luke Southwell Osborne

Richard William Osborne

Cédric Alain Marie Fournet

Samuel Alexander Webster

Kapil Vaswani

Manuel Costa

David Thomas Chisnall

Saurabh Mohan Kulkarni

Hachem Yassine

Balaji Vembu

Simon Christian Knowles

Lars Paul Huse

David Lacey

Kenneth Gordon

A peripheral device, for use with a host, comprises one or more compute elements a security module and at least one encryption unit. The security module is configured to form a trusted execution environment on the peripheral device for processing sensitive data using sensitive code. The sensitive data and sensitive code are provided by a trusted computing entity which is in communication with the host computing device. The at least one encryption unit is configured to encrypt and decrypt data transferred between the trusted execution environment and the trusted computing entity via the host computing device. The security module is configured to compute and send an attestation to the trusted computing entity to attest that the sensitive code is in the trusted execution environment.

Peripheral device

A processing system comprising one or more chips, each comprising a plurality of tiles is described. Each tile comprises a respective processing unit and memory, the memory storing a codelet. The processing system has at least one encryption unit configured to encrypt and decrypt data transferred between the tiles and a trusted computing entity via an external computing device. The codelets are configured to instruct the tiles to transfer the encrypted data by reading from and writing to a plurality of memory regions at the external memory such that a plurality of streams of encrypted data are formed, each stream using an individual one of the memory regions at the external computing device.

Streaming data to multi-tile processing system

A system and method for encrypting and decrypting data exchanged between a multi-tile processing unit and a storage, where a plurality of keys are used for the encryption. Each of the plurality of keys is associated with a different one or more sets of the processors. Encryption hardware is configured to select a key to use for encryption/decryption operations in dependence upon the set of tiles associated with the data being exchanged. Each write request from a tile contains identifier bits associated with that tile's set of tiles, enabling the encryption hardware to select the key to use for encrypting the data in the write request. Each read completion for a tile contains identifier bits associated with that tile's set of tiles, enabling the encryption hardware to select the key to use for decrypting the data in the read completion.

Multiple key management

The device implements a processing pipeline having distinct circuitry for performing encryption/decryption operations and authentication operations and having state stores associated with the respective operations. The state stores store state associated with a given encryption frame, enabling the respective operations to be performed when blocks of data reach that stage in the pipeline. Due to the complexity of operations in a block cipher encryption scheme, the pipeline is deep, which provide the possibility for processing multiple data packets at any one time. The provision of the state stores at the stages in the pipeline at which they are required prevents stalling when a new data packet is received.

Block cipher encryption pipeline

A processing device has a plurality of interfaces and a plurality of processors. During different phases of execution of a computer program, different processors are associated with different interfaces, such that the connectivity between processors and interfaces for the sending of egress data and the receiving of ingress data may change during execution of that computer program. The change in this connectivity is directed by the compiled code running on the processors. The compiled code selects which buses associated with which interfaces, given processors are to connect to for receipt of ingress data. Furthermore, the compiled code causes control messages to be sent to circuitry associated with the interfaces, so as to control which buses associated with which processors, given interfaces are to connect to.

External exchange connectivity

A device comprising a processing unit having a plurality of processors is provided. At least one encryption unit is provided as part of the device for encrypting data written by the processors to external storage and decrypting data read from that storage. The processors are divided into different sets, with state information held in the encryption unit for performing encryption/decryption operations for requests for different sets of processors. This enables interleaved read completions or write requests from different sets of processors to be handled by the encryption unit, since associated state information for each set of processors is independently maintained.

Encryption and decryption for a multi-tile processing unit

Signature generation circuitry is configured to update a signature in response to each of a plurality of writes to memory. The signature is updated by performing bitwise operations between current bit values of the signature and at least some of the bits written to memory in response a write. The bitwise operation are order-independent such that the resulting signature is the same irrespective of the order in which the writes are used to update the signature. The signatures are formed in an order-independent manner such that, if no errors have occurred in generating the data to be written to be memory, the signatures will match. In this way, a compact signature is developed that is suitable export from the data processing device for checking against a corresponding data processing device of a machine running a duplicate application.

Signature generation by a data processing device

A processor comprising at least one processing module, each processing module comprising: an execution pipeline; memory; an instruction fetch unit comprising operable to switch between an operational mode and a debugging mode, the instruction fetch unit being configured so as, when in the operational mode, to fetch machine code instructions from the memory into the execution pipeline to be executed; and a debug interface for connecting to a debug adapter. The debug interface comprises a debug instruction register enabling the debug adapter to write a machine code instruction to the debug instruction register, and wherein the instruction fetch unit is configured so as, when in the debug mode, to fetch instructions from the debug instruction register into the pipeline instead of from the memory.

Debugging instruction register to receive and input debugging instructions to a processor for a thread of execution in a debug mode

A method for controlling the sending of data by a plurality of processors belonging to a device, the method comprising: sending a first message to a first processor of the plurality of processors to grant permission to the first processor of the plurality of processors to send a first set of data packets over at least one external interface of the device; receiving from the first processor, an identifier of a second processor of the plurality of processors; and in response to receipt of the identifier of the second processor, send a second message to the second processor to grant permission to the second processor to send a second set of data packets over the at least one external interface.

Control of data sending from a multi-processor device

A hardware module comprises at least a first ingress buffer and a second ingress buffer, where the second ingress buffer holds data packets from a plurality of source components. To ensure fairness between one or more sources providing data to the first ingress buffer and the plurality of sources providing data to the second ingress buffer, processing circuitry examines source identifiers in packets held in the second ingress buffer and selects between the buffers so as to arbitrate between the sources. In some embodiments, the examination of the source identifiers provides statistics for a weighted round robin between the ingress buffers. In other embodiments, the source identifier of whichever packet is currently at the head of the second ingress buffer is used to perform a simple round robin between the sources.

Fair arbitration between multiple sources targeting a destination

A device comprising: a control bus; a plurality of requesting circuits each accessible on the control bus, wherein each of the plurality of requesting circuits is operable to dispatch read or write requests to the control bus for delivery to at least one of a plurality of receiving circuits, and the plurality of receiving circuits each accessible on the control bus, and each of which is operable to receive requests from the at least one control bus and service the requests by providing at least one of read or write access to storage associated with the respective receiving circuit, wherein the control bus provides a ring path configured to support, the requests in circulation in the ring path, wherein the control bus is configured to propagate each of at least some of the requests at least until those requests have been serviced by at least one of the receiving circuits.

Processing device comprising control bus

A device comprising: a bus forming a ring path for circulation of one or more data packets around the bus, wherein the one or more data packets comprises a trace report packet for collecting trace data from a plurality of components attached to the bus, wherein the bus is configured to repeatedly circulate the trace report packet with a fixed time period taken for each circulation of the ring path performed by the trace report packet; and the plurality of components, each of which comprises circuitry configured to, upon reception of the trace report packet at the respective component, insert one or more items of the trace data that have been obtained by the respective component.

Tracing activity from multiple components of a device

A processor in a network has a plurality of processing units arranged on a chip. An on-chip interconnect enables data to be exchanged between the processing units. A plurality of external interfaces are configured to communicate data off chip in the form of packets, each packet having a destination address identifying a destination of the packet. The external interfaces are connected to respective additional connected processors. A routing bus routes packets between the processing units and the external interfaces. A routing register defines a routing domain for the processor, the routing domain comprising one or more of the additional processor, and at least a subset of further additional processors of the network, wherein the additional processors of the subset are directly or indirectly connected to the processor. The routing domain can be modified by changing the contents of the routing register as a sliding window domain.

Routing in a network of processors

Access permissions are set for different requesting circuits on a control bus. The access permissions can be set by the level 1 manager and the level 2 manager, allowing two layers of security to be added. The level 1 manager has priority, allowing it to add access permissions that cannot be removed by the level 2 manager.

Growing community of inventors

Chippenham, United Kingdom

Graham Bernard Cunningham