Intel Corporation

Intel-ne, Inc.

International Business Machines Corporation

Robert O Sharp

Kenneth G Keels

Sujoy Sen

Reshma Lal

Pradeep M Pappachan

Selvakumar Panneer

Luis S Kida

Soham Jayesh Desai

Brian S Hausauer

Donald Wood

Eliel Louzoun

John S Lacombe

Rajesh M Sankaran

Eliezer Tamir

Ben-Zion Friedman

Parthasarathy Sarangam

Ashok Raj

Steven Bernard McGowan

Pratik M Marolia

Theodore L Willke

Nrupal R Jani

Matthew R Wilcox

Vadim Makhervaks

Neerav Parikh

Ziye Yang

Mrittika Ganguli

Manasi Deval

Anjali Singhai Jain

Yadong Li

Bradley John Booth

Steen K Larsen

Changpeng Liu

Gregory J Bowers

Ygdal Naouri

Shaopeng He

Piotr Uminski

Roger K Richter

Eric W Multanen

Ryan E Hall

Chinh T Cao

Nestor A Fesas, Jr

Eric Rose

William Kass

Quentin H Stephenson

Vivek Kashyap

Banghao Ying

An apparatus to facilitate disaggregated computing for a distributed confidential computing environment is disclosed. The apparatus includes one or more processors to: provide a remote GPU middleware layer to act as a proxy for an application stack on a client platform that is separate from the remote server platform, wherein the remote GPU middleware layer comprises is to expose an abstraction of the remote GPU to userspace components of a remote GPU stack, the userspace components running on the client machine; communicate with a kernel mode driver of the one or more processors to cause the host memory to be allocated for data structures used to communicate commands between the client and the remote GPU; and invoke the kernel mode driver to submit a workload generated by the application stack, the workload submitted for processing by the remote GPU using the data structures allocated in the host memory.

Disaggregated computing for distributed confidential computing environment

A network interface controller can be programmed to direct write received data to a memory buffer via either a host-to-device fabric or an accelerator fabric. For packets received that are to be written to a memory buffer associated with an accelerator device, the network interface controller can determine an address translation of a destination memory address of the received packet and determine whether to use a secondary head. If a translated address is available and a secondary head is to be used, a direct memory access (DMA) engine is used to copy a portion of the received packet via the accelerator fabric to a destination memory buffer associated with the address translation. Accordingly, copying a portion of the received packet through the host-to-device fabric and to a destination memory can be avoided and utilization of the host-to-device fabric can be reduced for accelerator bound traffic.

Network interface for data transport in heterogeneous computing environments

An apparatus to facilitate disaggregated computing for a distributed confidential computing environment is disclosed. The apparatus includes a graphics processing unit (GPU) to: provide a virtual GPU monitor (VGM) to interface over a network with a middleware layer of a client platform, the VGM to interface with the middleware layer using a message passing interface; configure and expose, by the VGM, virtual functions (VFs) of the GPU to the middleware layer of the client platform; intercept, by the VGM, request messages directed to the GPU from the middleware layer, the request messages corresponding to VFs of the GPU to be utilized by the client platform; and generate, by the VGM, a response to the request messages for the middleware client.

Examples described herein relate to accessing an initiator as a Non-Volatile Memory Express (NMVe) device. In some examples, the initiator is configured with an address space, configured in kernel or user space, for access by a virtualized execution environment. In some examples, the initiator to copy one or more storage access commands from the virtualized execution environment into a queue for access by a remote direct memory access (RDMA) compatible network interface. In some examples, the network interface to provide Non-Volatile Memory Express over Fabrics (NVMe-oF) compatible commands based on the one or more storage access commands to a target storage device. In some examples, the initiator is created as a mediated device in kernel space or user space of a host system. In some examples, configuration of a physical storage pool address of the target storage device for access by the virtualized execution environment occurs by receipt of the physical storage pool address in a configuration command. In some examples, configuration of the target storage device for access by the virtualized execution environment occurs by receipt of a storage pool internal NVMe Qualified Name in the configuration command.

Intermediary for storage command transfers

An apparatus to facilitate disaggregated computing for a distributed confidential computing environment is disclosed. The apparatus includes one or more processors to facilitate receiving a manifest corresponding to graph nodes representing regions of memory of a remote client machine, the graph nodes corresponding to a command buffer and to associated data structures and kernels of the command buffer used to initialize a hardware accelerator and execute the kernels, and the manifest indicating a destination memory location of each of the graph nodes and dependencies of each of the graph nodes; identifying, based on the manifest, the command buffer and the associated data structures to copy to the host memory; identifying, based on the manifest, the kernels to copy to local memory of the hardware accelerator; and patching addresses in the command buffer copied to the host memory with updated addresses of corresponding locations in the host memory.

Methods and apparatus for software-controlled active-backup mode of link aggregation for RDMA and virtual functions. A Network Interface Controller (NIC) includes hardware implementing first and second physical functions (PFs) including transmit and receive resources to support data transfers via first and second ports. A bonding group is created with the first and second PFs. The first PF as an active PF and used for primary data transfers while implementing the second PF as a backup PF. On a link or port failure of the active PF, the bonding group is reconfigured to employ transmit and receive resources of the backup PF such that those resources are shared with the active PF. Data transfers are then performed using the shared resources of the active PF and the backup PF. Embodiments may support RDMA data transfers using PF bonding and the solution may be implemented in virtualized environments including virtual machines (VMs) in a manner transparent to the VMs.

Software-controlled active-backup mode of link aggregation for RDMA and virtual functions

An apparatus to facilitate disaggregated computing for a distributed confidential computing environment is disclosed. The apparatus includes a programmable integrated circuit (IC) comprising secure device manager (SDM) hardware circuitry to: receive a tenant bitstream of a tenant and a tenant use policy for utilization of the programmable IC via the tenant bitstream, wherein the tenant use policy is cryptographically bound to the tenant bitstream by a cloud service provider (CSP) authorizing entity and signed with a signature of the CSP authorizing entity; in response to successfully verifying the signature, extract the tenant use policy to provide to a policy manager of the programmable IC for verification; in response to the policy manager verifying the tenant bitstream based on the tenant use policy, configure a partial reconfiguration (PR) region of the programmable IC using the tenant bitstream; and associate a slot ID of the PR region with the tenant use policy.

An apparatus to facilitate disaggregated computing for a distributed confidential computing environment is disclosed. The apparatus includes one or more processors to: provide a remote GPU middleware layer to act as a proxy for an application stack on a client platform separate from the apparatus; communicate, by the remote GPU middleware layer, with a kernel mode driver of the one or more processors to cause the host memory to be allocated for command buffers and data structures received from the client platform for consumption by a command streamer of a remote GPU of the apparatus; and invoke, by the remote GPU middleware layer, the kernel mode driver to submit a workload generated by the application stack, the workload submitted for processing by the remote GPU using the command buffers and the data structures allocated in the host memory as directed by the command streamer.

An apparatus to facilitate disaggregated computing for a distributed confidential computing environment is disclosed. The apparatus includes a source remote direct memory access (RDMA) network interface controller (RNIC); a queue to store a data entry corresponding to an RDMA request between the source RNIC and a sink RNIC; a data buffer to store data for an RDMA transfer corresponding to the RDMA request, the RDMA transfer between the source RNIC and the sink RNIC; and a trusted execution environment (TEE) comprising an authentication tag controller to: initialize a first authentication tag calculated using a first key known between a source consumer generating the RDMA request and the source RNIC; associate the first authentication tag with the data entry as integrity verification; initialize a second authentication tag calculated using a second key; and associate the second authentication tag with the data buffer as integrity verification for the data buffer.

An apparatus to facilitate disaggregated computing for a distributed confidential computing environment is disclosed. The apparatus includes a processor executing a trusted execution environment (TEE) comprising a field-programmable gate array (FPGA) driver to interface with an FPGA device that is remote to the apparatus; and a remote memory-mapped input/output (MMIO) driver to expose the FPGA device as a legacy device to the FPGA driver, wherein the processor to utilize the remote MMIO driver to: enumerate the FPGA device using FPGA enumeration data provided by a remote management controller of the FPGA device, the FPGA enumeration data comprising a configuration space and device details; load function drivers for the FPGA device in the TEE; create corresponding device files in the TEE based on the FPGA enumeration data; and handle remote MMIO reads and writes to the FPGA device via a network transport protocol.

Technologies for remote direct memory access (RDMA) queue pair quality of service (QoS) management are disclosed. In the illustrative embodiment, several queue pairs associated with a virtual machine on a compute sled may be created in a network interface controller of the compute sled. A QoS parameter such as a class of service identifier or a weighting may be assigned to each queue pair such that each queue pair has a different available bandwidth. The compute sled may also predict future RDMA queue pair bandwidth usage and adjust RDMA queue pair bandwidth allocation based on the prediction.

Technologies for RDMA queue pair QOS management

Tenant support is provided in a multi-tenant configuration in a data center by a Physical Function driver communicating a virtual User Priority to a virtual traffic class mapper to a Virtual Function driver. The Physical Function driver configures the Network Interface Controller to map virtual User Priorities to Physical User Priorities and to enforce the Virtual Function's limited access to Traffic Classes. Data Center Bridging features assigned to the physical network interface controller are hidden by virtualizing user priorities and traffic classes. A virtual Data Center Bridging configuration is enabled for a Virtual Function, to provide access to the user priorities and traffic classes that are not visible to the Virtual Function that the Virtual Function may need.

Method and apparatus for secure data center bridging in a multi-tenant system

Growing community of inventors

Round Rock, TX, United States of America

Robert O Sharp