Data Processing Unit (DPU)

The DPU integrates a high-speed NIC capable of 25-400 Gbps, but its core value is offloading entire networking data paths. It handles OVS (Open vSwitch) and VXLAN encapsulation/decapsulation in hardware, freeing host CPU cores from interrupt-driven packet processing. This enables bare-metal performance for virtualized control functions.

Unlike fixed-function NICs, a DPU features programmable packet processing engines (often based on P4 or ARM/RISC-V cores). This allows engineers to inject custom inline logic directly into the data plane:

• Custom protocol parsing for legacy industrial buses
• Inline telemetry extraction without CPU polling
• Line-rate packet filtering and transformation

DPUs expose NVMe storage devices to the host as local block devices while actually managing them over a fabric network (NVMe-oF). The DPU emulates a standard storage controller, completely offloading compression, deduplication, and encryption (AES-XTS). This is critical for hyperconverged industrial edge servers where storage I/O must not compete with control cycles.

A DPU establishes a hardware-isolated security domain separate from the host CPU. It implements a Root of Trust (RoT) via immutable boot ROM, enabling:

• Secure boot and attestation of the host system
• Inline IPsec/TLS termination at line rate
• A hardware firewall enforcing micro-segmentation policies before traffic reaches the host OS This zero-trust architecture prevents compromised control applications from lateral movement.

The DPU's embedded management processor operates independently of the host OS, enabling lights-out management. It can provision the host server via PXE, mount virtual media, and provide a remote KVM console. For virtualized PLC deployments, this allows a central orchestrator to deploy a fresh immutable infrastructure image to a blank edge server without any manual intervention.

By offloading noisy-neighbor storage and network I/O to the DPU, the host CPU cores are dedicated exclusively to real-time control workloads. This eliminates scheduling jitter caused by interrupt storms. Combined with CPU pinning and SR-IOV, the DPU guarantees that a virtualized Soft PLC executing a PREEMPT_RT kernel receives uncontended, deterministic access to its assigned cores.

A PCIe feature that allows two separate processor domains (e.g., a host CPU and a DPU's embedded processor) to communicate without creating a single shared memory hierarchy. NTB provides electrical isolation and fault containment, ensuring that a crash in the DPU's control plane cannot propagate to corrupt the safety-critical runtime on the host.