Abstract: An embodiment of an integrated circuit comprises circuitry to store memory protection information for a non-host memory in a memory protection cache, and perform one or more memory protection checks on a translated access request for the non-host memory based on the stored memory protection information. Other embodiments are disclosed and claimed.

Abstract: An embodiment of an integrated circuit comprises circuitry to share page tables associated with a page between a processor memory management unit (MMU) and an input/output memory management unit (IOMMU), store a page table entry in the memory associated with the page, and separately control access to the page from a processor and from a direct memory access (DMA) request based on one or more fields of the stored page table entry. Other embodiments are disclosed and claimed.

Abstract: Embodiments are directed to providing a secure address translation service. An embodiment of a system includes a memory device to store memory data in a plurality of physical pages shared by a plurality of devices, a first table to map each page of memory to an associated bundle identifier (ID) that identifies one or more devices having access to a page of memory, a second table to map each bundle ID to page access permissions that define access to one or more pages associated with a bundle ID and a translation agent to receive requests from the plurality of devices to perform memory operations on the memory and determine page access permissions for requests received from the plurality of devices using the first table and the second table.

Abstract: Examples may include a method of instantiating a virtual machine; instantiating a virtual device to transmit data to and receive data from assigned resources of a shared physical device by receiving input data requesting assigned resources for the virtual device, allocating assigned resources to the virtual device based at least in part on the input data, and mapping a page location in an address space of the shared physical device for a selected one of the assigned resources to a page location in a memory-mapped input/output (MMIO) space of the virtual device; and assigning the virtual device to the virtual machine, the virtual machine to transmit data to and receive data from the physical device via the MMIO space of the virtual device.

Abstract: A processing device is provided. The processing device comprises an interface configured to receive information about an operation state of a surrogate processor. Further, the processing device comprises a processing circuitry configured to control the interface and to decide whether an interrupt addressed to the processing circuitry is processed by the processing circuitry or redirected to the surrogate processing circuitry based on an operation state of the processing circuitry and the surrogate processing circuitry.

Abstract: Examples may include a method of instantiating a virtual machine, instantiating a virtual device to transmit data to and receive data from assigned resources of a shared physical device; and assigning the virtual device to the virtual machine, the virtual machine to transmit data to and receive data from the physical device via the virtual device.

Abstract: Examples include a method of performing failover of in an I/O architecture by allocating a first set of resources, associated with a first port of a physical device, to a virtual device, allocating a second set of resources, associated with a second port of the physical device, to the virtual device, assigning the virtual device to a virtual machine, activating the first set of resources, and transferring data between the virtual machine and the first port using the virtual device and the first set of resources. The method further includes detecting an error in the first set of resources, deactivating the first set of resources and activating the second set of resources, and transferring data between the virtual machine and the second port using the virtual device and the second set of resources.

Abstract: In one embodiment, a processor comprises: a first configuration register to store a pointer to a process address space identifier (PASID) table; and an execution circuit coupled to the first configuration register. The execution circuit, in response to a first instruction, is to obtain command data from a first location identified in a source operand of the first instruction, obtain a PASID table handle from the command data, access a first entry of the PASID table using the pointer from the first configuration register and the PASID table handle to obtain a PASID value, insert the PASID value into the command data, and send the command data to a device coupled to the processor. Other embodiments are described and claimed.

Abstract: A system comprising an accelerator circuit comprising an accelerator function unit to implement a first function, and one or more device feature header (DFH) circuits to provide attributes associated with the accelerator function unit, and a processor to retrieve the attributes of the accelerator function unit by traversing a device feature list (DFL) referencing the one or more DFH circuits, execute, based on the attributes, an application encoding the first function to cause the accelerator function unit to perform the first function.

Abstract: Technologies for secure device configuration and management include a computing device having an I/O device. A trusted agent of the computing device is trusted by a virtual machine monitor of the computing device. The trusted agent securely commands the I/O device to enter a trusted I/O mode, securely commands the I/O device to set a global lock on configuration registers, receives configuration data from the I/O device, and provides the configuration data to a trusted execution environment. In the trusted I/O mode, the I/O device rejects a configuration command if a configuration register associated with the configuration command is locked and the configuration command is not received from the trusted agent. The trusted agent may provide attestation information to the trusted execution environment. The trusted execution environment may verify the configuration data and the attestation information. Other embodiments are described and claimed.

Abstract: Systems, methods, and devices for isolating a misbehaving accelerator circuit, such as an accelerator function unit or an accelerated function context, are provided. An integrated circuit may include a region that includes an accelerator circuit. When the accelerator circuit issues a request, another region of the integrated circuit or a processor connected to the integrated circuit may determine whether there is a misbehavior associated with the request and, in response to determining that there is a misbehavior associated with the request, may perform a misbehavior response to mitigate a negative impact of the misbehavior of the accelerator circuit.

Abstract: Device memory protection for supporting trust domains is described. An example of a computer-readable storage medium includes instructions for allocating device memory for one or more trust domains (TDs) in a system including one or more processors and a graphics processing unit (GPU); allocating a trusted key ID for a TD of the one or more TDs; creating LMTT (Local Memory Translation Table) mapping for address translation tables, the address translation tables being stored in a device memory of the GPU; transitioning the TD to a secure state; and receiving and processing a memory access request associated with the TD, processing the memory access request including accessing a secure version of the address translation tables.

Abstract: Security and support for trust domain operation is described. An example of a method includes processing, at an accelerator, one or more compute workloads received from a host system; upon receiving a notification that a trust domain has transitioned to a secure state, transition an original set of privileges for the accelerator to a downgraded set of privileges; upon receiving a command from the host system for the trust domain, processing the command in accordance with the trust domain; and upon receiving a request from the host system to access a register, for a register included in an allowed list of registers for access, allow access to the register, and, for a register that is not within the allowed list of registers for access, disallowing access to the register.

Abstract: A method includes receiving at a management component of an FPGA a persona change request and issuing a request by the management component to a reconfigurable PR slot of the FPGA to change a first persona of a first circuit device of the FPGA to a second persona of a second circuit device of the FPGA. The management component, the reconfigurable PR slot, and the first and second circuit devices are configured in the FPGA core. The method includes switching by the reconfigurable PR slot the first persona to the second persona. The method includes issuing a request by the management component, a host re-enumeration of the reconfigurable PR slot, triggering by the host a re-enumeration component a re-enumeration of the reconfigurable PR slot, and exposing by the reconfigurable PR slot the second persona such that the host is reconfigured to recognize the second circuit device.

Abstract: Methods, apparatus, systems, and articles of manufacture to manage memory in a computing apparatus are disclosed. Methods, apparatus, systems, and articles of manufacture to optimize or improve buffer invalidation to reduce memory management performance overhead are disclosed. An example apparatus includes an input-output memory management unit (IOMMU) circuitry to control access to memory circuitry, the IOMMU circuitry to increment a counter from a first value to a second value when a memory access to a location in the memory circuitry is allocated and to decrement the counter from the second value to the first value when the memory access to the location in the memory circuitry is deallocated; and an operating system (OS) memory manager to enable reallocation of the location in the memory circuitry when the counter is at the first value.

Abstract: Systems, methods, and devices for isolating a misbehaving accelerator circuit, such as an accelerator function unit or an accelerated function context, are provided. An integrated circuit may include a region that includes an accelerator circuit. When the accelerator circuit issues a request, another region of the integrated circuit or a processor connected to the integrated circuit may determine whether there is a misbehavior associated with the request and, in response to determining that there is a misbehavior associated with the request, may perform a misbehavior response to mitigate a negative impact of the misbehavior of the accelerator circuit.

Abstract: Implementations of the disclosure provide processing device comprising: an interrupt managing circuit to receive an interrupt message directed to an application container from an assignable interface (AI) of an input/output (I/O) device. The interrupt message comprises an address space identifier (ASID), an interrupt handle and a flag to distinguish the interrupt message from a direct memory access (DMA) message. Responsive to receiving the interrupt message, a data structure associated with the interrupt managing circuit is identified. An interrupt entry from the data structure is selected based on the interrupt handle. It is determined that the ASID associated with the interrupt message matches an ASID in the interrupt entry. Thereupon, an interrupt in the interrupt entry is forwarded to the application container.

Abstract: In one embodiment, a read request is received from a peripheral device across an interconnect, with the read request including a process identifier and an encrypted virtual address. One or more keys are obtained based on the process identifier of the read request, and the encrypted virtual address of the read request is decrypted based on the one or more keys to obtain an unencrypted virtual address. Encrypted data is retrieved from memory based on the unencrypted virtual address, and the encrypted data is decrypted based on the one or more keys to obtain plaintext data. The plaintext data is transmitted to the peripheral device across the interconnect.

Abstract: Technologies for secure device configuration and management include a computing device having an I/O device. A trusted agent of the computing device is trusted by a virtual machine monitor of the computing device. The trusted agent securely commands the I/O device to enter a trusted I/O mode, securely commands the I/O device to set a global lock on configuration registers, receives configuration data from the I/O device, and provides the configuration data to a trusted execution environment. In the trusted I/O mode, the I/O device rejects a configuration command if a configuration register associated with the configuration command is locked and the configuration command is not received from the trusted agent. The trusted agent may provide attestation information to the trusted execution environment. The trusted execution environment may verify the configuration data and the attestation information. Other embodiments are described and claimed.

Abstract: Techniques for scalable virtualization of an Input/Output (I/O) device are described. An electronic device composes a virtual device comprising one or more assignable interface (AI) instances of a plurality of AI instances of a hosting function exposed by the I/O device. The electronic device emulates device resources of the I/O device via the virtual device. The electronic device intercepts a request from the guest pertaining to the virtual device, and determines whether the request from the guest is a fast-path operation to be passed directly to one of the one or more AI instances of the I/O device or a slow-path operation that is to be at least partially serviced via software executed by the electronic device. For a slow-path operation, the electronic device services the request at least partially via the software executed by the electronic device.