Abstract: Creating hybrid virtual devices using a plurality of physical functions. A processor of a device may identify a plurality of physical functions accessible to the device, the plurality of physical functions including a first physical function and a second physical function. The processor may create a virtual device to comprise the first physical function to provide a first capability and the second physical function to provide a second capability, wherein the first capability and second capability are different capabilities.

Abstract: Various embodiments are generally directed to securing systems that include hardware accelerators, such as FPGA-based accelerators, and privileged system components. Some embodiments may provide a security broker. In various embodiments, the security broker may provide interfaces between the hardware accelerator and the privileged component. Some embodiments may receive an instruction from the hardware accelerator targeting the privileged component, and validate the instruction based on a configuration. In some embodiments, upon determining the instruction is not validated, the instruction is restricted from further processing.

Abstract: Examples described herein relate to circuitry configured to generate at least one virtual device interface to utilize the processor circuitry and provide the at least one virtual device interface to a server to assign to a process to provide the process with capability to utilize the processor circuitry. In some examples, the processor circuitry is to perform one or more of local area network access, cryptographic processing, and/or storage access. In some examples, the storage access comprises access to one or more Non-volatile Memory Express (NVMe) devices.

Abstract: Systems, methods, and apparatuses for accelerating streaming data-transformation operations are described.

Abstract: Embodiments of apparatuses, methods, and systems for hardware manage address translation services are described. In an embodiment, an apparatus includes a first interconnect, a second interconnect, address translation hardware, a device, a translation lookaside buffer. The address translation hardware is coupled to the interconnect and is to provide a translation of a first address to a second address. The device is coupled to the first interconnect and the second interconnect and is to provide the first address to the address translation hardware through the first interconnect. The translation lookaside buffer includes an entry to store the translation, which is to be provided to the translation lookaside buffer through the first interconnect by the address translation hardware. The device is to access a system memory through the second interconnect using the second address from the entry in the translation lookaside buffer.

Abstract: A system comprising an accelerator circuit comprising an accelerator function unit to implement a first function, and one or more device feature header (DFH) circuits to provide attributes associated with the accelerator function unit, and a processor to retrieve the attributes of the accelerator function unit by traversing a device feature list (DFL) referencing the one or more DFH circuits, execute, based on the attributes, an application encoding the first function to cause the accelerator function unit to perform the first function.

Abstract: Systems, methods, and apparatuses relating to performing an attachment of an input-output memory management unit (IOMMU) to a device, and a verification of the attachment. In one embodiment, a protocol and IOMMU extensions are used by a secure arbitration mode (SEAM) module and/or circuitry to determine if the IOMMU that is attached to the device requested to be mapped to a trusted domain.

Abstract: Systems, apparatuses, methods, and computer-readable media are provided for device interface management. A device includes a device interface, a virtual machine (VM) includes a device driver, both to facilitate assignment of the device to the VM, access of the device by the VM, or removal of the device from being assigned to the VM. The VM is managed by a hypervisor of a computing platform coupled to the device by a computer bus. The device interface includes logic in support of a device management protocol to place the device interface in an unlocked state, a locked state to prevent changes to be made to the device interface, or an operational state to enable access to device registers of the device by the VM or direct memory access to memory address spaces of the VM, or an error state. Other embodiments may be described and/or claimed.

Abstract: Apparatus and method for high-performance page fault handling. For example, one embodiment of an apparatus comprises: one or more accelerator engines to process work descriptors submitted by clients to a plurality of work queues; fault processing hardware logic associated with the one or more accelerator engines, the fault processing hardware logic to implement a specified page fault handling mode for each work queue of the plurality of work queues, the page fault handling modes including a first page fault handling mode and a second page fault handling mode.

Abstract: Examples may include a computing platform having a host driver to get a packet descriptor of a received packet stored in a receive queue and to modify the packet descriptor from a first format to a second format. The computing platform also includes a guest virtual machine including a guest driver coupled to the host driver, the guest driver to receive the modified packet descriptor and to read a packet buffer stored in the receive queue using the modified packet descriptor, the packet buffer corresponding to the packet descriptor.

Abstract: Methods and apparatus relating to scalable access control checking for cross-address-space data movement are described. In an embodiment, a memory stores an InterDomain Permissions Table (IDPT) having a plurality of entries. At least one entry of the IDPT provides a relationship between a target address space identifier and a plurality of requester address space identifiers. A hardware accelerator device allows access to a target address space, corresponding to the target address space identifier, by one or more of requesters, corresponding to the plurality of requester address space identifiers, respectively, based at least in part on the relationship provided by the at least one entry of the IDPT. Other embodiments are also disclosed and claimed.

Abstract: Methods and apparatus relating to data streaming accelerators are described. In an embodiment, a hardware accelerator such as a Data Streaming Accelerator (DSA) logic circuitry provides high-performance data movement and/or data transformation for data to be transferred between a processor (having one or more processor cores) and a storage device. Other embodiments are also disclosed and claimed.

Abstract: In one embodiment, a processor comprises: a first configuration register to store a pointer to a process address space identifier (PASID) table; and an execution circuit coupled to the first configuration register. The execution circuit, in response to a first instruction, is to obtain command data from a first location identified in a source operand of the first instruction, obtain a PASID table handle from the command data, access a first entry of the PASID table using the pointer from the first configuration register and the PASID table handle to obtain a PASID value, insert the PASID value into the command data, and send the command data to a device coupled to the processor. Other embodiments are described and claimed.

Abstract: Examples include a method of live migrating a virtual device by creating a virtual device in a virtual machine, creating first and second interfaces for the virtual device, transferring data over the first interface, detecting a disconnection of the virtual device from the virtual machine, switching data transfers for the virtual device from the first interface to the second interface, detecting a reconnection of the virtual device to the virtual machine, and switching data transfers for the virtual device from the second interface to the first interface.

Abstract: Examples may include a method of protecting memory and I/O transactions. The method includes allocating memory for an application, assigning a resource of a physical device to the application, assigning a process address space identifier to the assigned resource, creating a security enclave to protect the allocated memory of the application, and associating the security enclave with the process address space identifier to protect the allocated memory and the assigned resource.

Abstract: Techniques for transferring virtual machines and resource management in a virtualized computing environment are described. In one embodiment, for example, an apparatus may include at least one memory, at least one processor, and logic for transferring a virtual machine (VM), at least a portion of the logic comprised in hardware coupled to the at least one memory and the at least one processor, the logic to generate a plurality of virtualized capability registers for a virtual device (VDEV) by virtualizing a plurality of device-specific capability registers of a physical device to be virtualized by the VM, the plurality of virtualized capability registers comprising a plurality of device-specific capabilities of the physical device, determine a version of the physical device to support via a virtual machine monitor (VMM), and expose a subset of the virtualized capability registers associated with the version to the VM. Other embodiments are described and claimed.

Abstract: A device includes a plurality of ports and a plurality of capability registers that correspond to a respective one of the plurality of ports. The device is to connect to one or more processors of a host device through the plurality of ports, and each of the plurality of ports comprises a respective protocol stack to support a respective link between the corresponding port and the host device according to a particular interconnect protocol. Each of the plurality of capability registers comprises a respective set of fields for use in configuration of the link between its corresponding port and one of the one or more processors of the host device. The fields include a field to indicate an association between the port and a particular processor, a field to indicate a port identifier for the port, and a field to indicate a total number of ports of the device.

Abstract: Techniques and mechanisms for an input-output memory management module (IOMMU) to indicate to software whether a page request by an endpoint device is to be serviced. In an embodiment, the IOMMU receives from the endpoint device a response to an invalidation wait message. Based on the response, the IOMMU provides first information which indicates to software that page requests have been flushed from the endpoint device. Page request message from the endpoint device are compatible with an interface standard which also comprises a stop marker message type. The first information is provided independent of the endpoint device providing any message which is of the stop marker message type. In another embodiment, the first information includes a drain marker generated by the IOMMU, or a snapshot of an address corresponding to an end of a page request queue.

Abstract: Examples include techniques to enable quality of service (QoS) control for an accelerator device. Circuitry at an accelerator device implements QoS control responsive to receipt of a submission descriptor for a work request to execute a workload for an application hosted by a compute device coupled with the accelerator device. An example QoS control includes accepting the submission descriptor to a work queue at the accelerator device based on a work size of submission descriptor submissions of the application to the work queue over a unit of time not exceeding a submission rate threshold. The work queue is associated with an operational unit at the accelerator device to execute the workload based on information included in the submission descriptor. The work queue to be shared with at least one other application hosted by the compute device.

Abstract: An embodiment of an integrated circuit comprises circuitry to store memory protection information for a non-host memory in a memory protection cache, and perform one or more memory protection checks on a translated access request for the non-host memory based on the stored memory protection information. Other embodiments are disclosed and claimed.