Abstract: In a multitenant environment, confidential containers for the tenant having a trusted execution environment (TEE) which have security attested, can share data within the pod or between pods. The ability to share data for confidential containers of the same tenant eliminates the need to have multiple copies for different confidential containers. Thus, a storage device can store shared data specific to a tenant of the multitenant environment, and a caching service backed by protected hardware can manage access to the shared data. Management of the shared data can include attesting a key for a confidential container to verify that the confidential container is part of the TEE for a pod for the tenant, and access the shared data from the storage device for the confidential container based on the attested key.

Abstract: Examples described herein relate to circuitry to provide telemetry data of first circuitry based on a power state of the first circuitry and provide telemetry data of second circuitry based on a power state of the second circuitry.

Abstract: Examples described herein relate to receiving memory access requests in a first number of connections from one or more front-end clients destined to a storage system and consolidating the memory access requests to a second number of connections between a network device and the storage system, wherein the second number is less than the first number. In some examples, consolidating the memory access requests includes combining read commands with other read commands destined to the storage system among connections of the first number of connections and combining write commands with other write commands destined to a same storage system among connections of the first number of connections. In some examples, consolidating the memory access requests includes performing protocol conversion to a format accepted by the storage system. In some examples, read or write commands are identified based on content of a header of a received packet, wherein the received packet includes a read or write command.

Abstract: An apparatus is described. The apparatus includes a network interface having a system interface, a media access interface and circuitry to construct a block of null values for a logical block address (LBA) in response to a remote storage system having informed the network interface that the LBA was un-mappable.

Abstract: Examples described herein relate to receiving memory access requests in a first number of connections from one or more front-end clients destined to a storage system and consolidating the memory access requests to a second number of connections between a network device and the storage system, wherein the second number is less than the first number. In some examples, consolidating the memory access requests includes combining read commands with other read commands destined to the storage system among connections of the first number of connections and combining write commands with other write commands destined to a same storage system among connections of the first number of connections. In some examples, consolidating the memory access requests includes performing protocol conversion to a format accepted by the storage system. In some examples, read or write commands are identified based on content of a header of a received packet, wherein the received packet includes a read or write command.

Abstract: An apparatus is described. The apparatus includes a network interface having a system interface, a media access interface and circuitry to construct a block of null values for a logical block address (LBA) in response to a remote storage system having informed the network interface that the LBA was un-mappable.

Abstract: Systems and methods for a controller including controller memory and logic are presented herein. The logic is configured to control access to a persistent storage media and, in response to one or more commands, determine an intermediate parity value based on a first parity calculation by sending a uni-directional command to the persistent storage media. The logic is further configured to store, in the controller memory, the intermediate parity value, and determine a final parity value based on the intermediate parity value and a second parity calculation.

Abstract: Examples described herein relate to at least one processor and circuitry, when operational, to: cause a first number of processors of the at least one processor to access queues exclusively allocated for packets to be processed by the first number of processors; cause a second number of processors of the at least one processor to identify commands consistent with Non-volatile Memory Express (NVMe) over Quick User Data Protocol Internet Connections (QUIC), wherein the commands are received in the packets and the second number is based at least in part on a rate of received commands; and cause performance of the commands using a third number of processors. In some examples, the circuitry, when operational, is to: based on detection of a new connection on a first port, associate the new connection with a second port, wherein the second port is different than the first port and select at least one processor to identify and process commands received on the new connection.

Abstract: Examples described herein relate to a switch comprising a programmable data plane pipeline, wherein the programmable data plane pipeline is configured to provide microservice-to-microservice communications within a service mesh. In some examples, to provide microservice-to-microservice communications within a service mesh, the programmable data plane pipeline is to perform a forwarding operation for a communication from a first microservice to a second microservice. In some examples, to perform a forwarding operation for a communication from a first microservice to a second microservice, the programmable data plane pipeline is to utilize a reliable transport protocol.

Abstract: Examples relate to an apparatus, a device, a method, and a computer program for a computer system, and to a corresponding computer system. The apparatus comprises circuitry config-ured to provide an interface for accessing persistent memory provided by persistent memory circuitry of the computer system from one or more software applications. The circuitry is configured to translate instructions for performing operations on the persistent memory into corresponding instructions for offloading circuitry of the computer system, the corresponding instructions being suitable for instructing the offloading circuitry to perform the operations on the persistent memory. The circuitry is configured to provide the access to the persistent memory via the offloading circuitry.

Abstract: Methods and apparatus for end-to-end data plane offloading for distributed storage using protocol hardware and Protocol Independent Switch Architecture (PISA) devices. Hardware-based data plane forwarding is implemented in compute and storage switches that comprise smart server switches running software executing in a kernel and user space. The compute switch is coupled to one or more compute servers/nodes and the storage server is coupled to one or more storage servers or storage arrays. The hardware-based data plane forwarding facilitates an end-to-end data plane between the computer server(s) and storage server(s)/array(s) that is offloaded to hardware. In one example the software comprises Ceph components used to implement control plane operations in connection with hardware offloaded data plane operations, and storage traffic employs the NVMe-oF protocol and the kernels include NVMe-oF modules. In one aspect the hardware-based data plane forwarding is implemented using programmable P4switch chips.

Abstract: Examples described herein relate to accessing an initiator as a Non-Volatile Memory Express (NMVe) device. In some examples, the initiator is configured with an address space, configured in kernel or user space, for access by a virtualized execution environment. In some examples, the initiator to copy one or more storage access commands from the virtualized execution environment into a queue for access by a remote direct memory access (RDMA) compatible network interface. In some examples, the network interface to provide Non-Volatile Memory Express over Fabrics (NVMe-oF) compatible commands based on the one or more storage access commands to a target storage device. In some examples, the initiator is created as a mediated device in kernel space or user space of a host system. In some examples, configuration of a physical storage pool address of the target storage device for access by the virtualized execution environment occurs by receipt of the physical storage pool address in a configuration command.

Abstract: Examples described herein relate to offload reliable transport management to a network interface device and store packets to be resent, based on received packet receipt acknowledgements (ACKs), into one or more kernel space queues that are also accessible in user space.

Abstract: The disclosure concerns at least one processor that can execute a polling group to poll for storage transactions associated with a first group of one or more particular queue identifiers. The disclosure concerns at least one processor is configured to: execute a second polling group on a second processor, wherein the second polling group is to poll for storage transactions for a second group of one or more particular queue identifiers that are different than the one or more particular queue identifiers of the first group, wherein the second group of one or more particular queue identifiers are associated with one or more queues that can be accessed using the second polling group and not the first polling group.

Abstract: A method, system, and apparatus for deploying application units within a computing cluster is disclosed. The apparatus includes memory circuitry, machine-readable instructions, and processor circuitry configured to identify a plurality of worker nodes, each with a hardware-based security resource. The apparatus receives deployment requests specifying security requirements, selects compatible worker nodes based on these requirements, and schedules the application units for execution on the selected nodes.

Abstract: Examples relate to an apparatus, device, method, and computer program for providing access to offloading circuitry of a computer system, to a method and computer program for setting up access to offloading circuitry of a computer system, and to corresponding computer systems. The apparatus comprises circuitry configured to provide a common interface for accessing offloading circuitry of the computer system from one or more software applications. The circuitry is configured to select one of a kernel-space driver and a user-space driver for accessing the offloading circuitry. The circuitry is configured to provide the access to the offloading circuitry for the one or more software applications via the selected driver at runtime.

Abstract: Examples described herein relate to offload reliable transport management to a network interface device and store packets to be resent, based on received packet receipt acknowledgements (ACKs), into one or more kernel space queues that are also accessible in user space.

Abstract: The disclosure concerns at least one processor that can execute a polling group to poll for storage transactions associated with a first group of one or more particular queue identifiers. The disclosure concerns at least one processor is configured to: execute a second polling group on a second processor, wherein the second polling group is to poll for storage transactions for a second group of one or more particular queue identifiers that are different than the one or more particular queue identifiers of the first group, wherein the second group of one or more particular queue identifiers are associated with one or more queues that can be accessed using the second polling group and not the first polling group.

Abstract: An apparatus is described. The apparatus includes an accelerator to be coupled to a memory region that the accelerator shares with a virtualization environment comprising a guest OS, a guest VM and an SSD device driver. The accelerator is to forward a submission queue doorbell setting made by the SSD device driver in the shared memory to a corresponding submission queue doorbell in an SSD controller.

Abstract: An embodiment of an electronic apparatus may include one or more substrates, and logic coupled to the one or more substrates, the logic to control local access to a persistent storage media and, in response to one or more commands, to determine an intermediate parity value based on a first local parity calculation, locally store the intermediate parity value, and determine a final parity value based on the intermediate parity value and a second local parity calculation. Other embodiments are disclosed and claimed.