Chelsio Communications, Inc.

Silicon Graphics, Incorporated

Asgeir Thor Eiriksson

Wael Noureddine

Dimitrios Michailidis

Chris Yuhong Mao

Felix A Marti

Kianoosh Naghshineh

Mark D Stadler

Balekudru A Krishna

Patricio Kaplan

Shenze Chen

Anamaya Sullerey

Chandrasekhar Srinivasaiah

George E Smith

Yuval Koren

Givargis George Kaldani

Atul Gupta

Doug Solomon

Suman Kumar M Venkata

A network adaptor (or NIC) is equipped with multi-level protocol processing capability and is implemented with a protocol processing pipeline that has multiple tap points to enable the integration of co-processors to operate with the NIC. The capability leverages the protocol processing pipeline and all the existing NIC software while at the same time enabling the integration of value added co-processors to customize and enhance the NIC capabilities.

Method to integrate co-processors with a protocol processing pipeline

Data replication can be supported efficiently in a protocol offload device (such as a protocol offload device to offload transport layer protocol processing from a host) by supporting a shared memory (SHM) abstraction for the send and receive buffers that are used in protocol offload devices. The protocol offload send and receive buffers are accessed using a per offloaded connection virtual address method that maps transport protocol sequence numbers (such as TCP protocol sequence numbers), to memory locations within buffers, and, for example, either page tables and paged memory or segment tables and segmented memory tables are used to access the memory.

Replication in a protocol offload network interface controller

We describe a method, device and system for communicating to a peer via a network. A segment is received formatted according to a first network protocol, the received segment having clear-text payload data in a payload portion of the received segment. A cryptographic operation is performed on at least a portion of the clear-text payload data of the received segment, according to a cryptographic protocol, and a PDU is embedded according to the cryptographic protocol into the payload portion of the received segment. Header data, in a header portion of the received segment, is to account for a change to the received segment resulting from the cryptographic operation performance. The received segment, having the embedded PDU according to the cryptographic protocol and the adjusted header data, is transmitted to a peer via the network.

Method for in-line TLS/SSL cleartext encryption and authentication

Network interface circuitry forms a local node. At least one processor offloads from a host computer at least one stateful communication connection between the host computer and a peer, and also operates a cache coherence protocol to scale coherent memory to multiple nodes. The processor operates the communication protocol processing offload at least in part according to communication connection states maintained in the memory, including accessing each communication connection state in the memory using the access procedure, to access that communication connection state in the memory according to an identifier corresponding to that communication connection state. The processor further operates the cache coherence protocol at least in part according to coherence states maintained in the memory, including accessing each coherence state in the memory using the access procedure, to access that coherence state in the memory according to an identifier corresponding to that coherence state.

Distributed cache coherent shared memory controller integrated with a protocol offload network interface card

Packet switching is facilitated between a source and a destination through a network interface card. In accordance with an aspect, a NIC is configured to switch ingress packets&#x2014;coming from the network&#x2014;selectively to one or multiple destinations (in a NIC which is capable of replicating packets) on the host computer, and alternatively or additionally (in a NIC which is capable of replicating packets) back to one or multiple destinations on the network. In multi-port NICs, this capability effectively allows a NIC to perform the basic functions of a standalone network switch as well as additional useful functions.

Method for efficient routing in a network interface card

Coupling circuitry couples a network to a host. The host operating system is configured for transfer of data between the host and at least one peer via the network using at least one stateful connection to a peer according to a connection-oriented protocol. The coupling circuitry processes received connection attempt indications by attempting to establish a stateful connection to an indicated peer. For a genuine attempt by a peer to establish a stateful connection with the host, the coupling circuitry interoperates with the peer to perform establishment-phase protocol processing of the attempted stateful connection. For each of the established stateful connections, the coupling circuitry operates to cause a state of that established stateful connection to be provided from the coupling circuitry to the host, wherein the operating system of the host handles data transfer phase protocol processing of that established stateful connection.

Network adaptor configured for connection establishment offload

Received PDU's, when inductively determined to be not aligned with a byte-stream payload, are stored within an intermediate dedicated buffer memory and then are read and further processed once alignment of further received PDU's has been derived and a whole PDU has been buffered. A PDU can then be read from the dedicated memory buffer and the PDU payload portion placed in the final destination buffer in system memory. Received PDU's when determined to be aligned with a byte-stream payload are placed in the final destination buffers in system memory, and when the PDU's arrive out-of-order are placed out of order in the final destination buffers.

Method for out of order placement in PDU-oriented protocols

A multi-port L2 to L7 switch may be implemented using multi-port switch building blocks such as a multi-port intelligent network interface card (NIC), without necessitating a dedicated switch. It is, for example, possible to build a 16-node switched interconnect from 16 4-port building blocks. Such a multi-port L2 to L7 switch may be used as a storage/compute cluster interconnect, where it replaces one or more external switches. The multi-port switch may utilize routing protocols such as IS-IS and OSPF. It may further support ACL, TCP proxy (L4 switching), iSCSI switching (L7 switching), and multi-function gateway capability, translating between different protocols such as iSCSI/FCoE/FC/SAS, etc.

Multi-function interconnect having a plurality of switch building blocks

A method and apparatus are provided for communication of a host having a first network interface device and a second network interface device coupled thereto. The first network interface device is configured to operate a transport layer network connection between the host and a peer. The host is configured to, while the first network device is operating the transport layer network connection with the peer, independently determine connection information that describes the transport layer network connection being operated by the first network interface device. The second network interface device is caused to operate the transport layer network connection with the peer based at least in part on the connection information maintained by the host.

Failover and migration for full-offload network interface devices

Coupling circuitry (such as an intelligent network adaptor) couples a network to a host. The host is executing an operating system and is configured for transfer of data between the host and at least one peer via the network using at least one stateful connection to a peer according to a connection-oriented protocol. Indications of attempts to establish stateful connections with a host are received. The coupling circuitry processes each of the received indications by attempting to establish a stateful connection to a peer indicated by that connection establishment attempt indication such that, for a genuine attempt by a peer to establish a stateful connection with the host, the coupling circuitry interoperates with the peer to perform establishment-phase protocol processing of the attempted stateful connection. For each of the established stateful connections, the coupling circuitry operates to cause a state of that established stateful connection to be provided from the coupling circuitry to the host, wherein the operating system of the host handles data transfer phase protocol processing of that established stateful connection.

Efficient congestion control in a packet switched network is facilitated between at least one source and at least one destination. The source organizes known destinations, at above the link layer, into groups, each group containing one or more destinations. The group for each source packet may be identifiable by data natively present in the packet header. In some example, the source assigns an arbitrary identification to each group, and the source labels packets destined to a group with the identification for that group. A network node sends 'PAUSE' packets containing at least one pause information indication back to a traffic source. The pause indication is associated with at least one group identification used by the source. The source reacts to the pause request by stopping or resuming packet transmission to the at least one group identification. Transmission to other destination groups is not affected.

Method for flow control in a packet switched network

A network interface controller (NIC) is configured to couple a host to a network. The NIC coupled to the host via a host bus, and the host is configured to operate a plurality of virtual machines. The NIC is configured to receive at least one data frame, the at least one data frame including at least a source network address and indication of at least one destination network address; determine if the received data frame is a frame on which additional processing should occur; based on a result of the determining step, cause the frame to be provided to the host, via the host bus, for the host to perform the additional processing; and receive, via the host bus, the frame on which additional processing has been performed and steer the frame to a destination based on the at least one destination address.

Intrusion detection and prevention processing within network interface circuitry

The present invention is in the field of virtualization of Network Interface Cards and Controllers (NIC) that connect to for example a host computer that can have multiple functions and OS's (referred to as guest functions and guest-OS's) running on it simultaneously and, in particular, relates to the virtualization of the operation of a single NIC such that it can be used simultaneously by multiple guests in such a manner that memory references due to the network traffic originating from and destined to a particular guest is kept separate from other network traffic, and that allows the Media Access Controller (MAC) within the NIC to operate such that it only accepts network packets that are destined to one of the guest-functions or guest-OS's, and the MAC is not required to operate in promiscuous mode where it accepts all incoming packets in order to implement the virtualization features.

Growing community of inventors

Sunnyvale, CA, United States of America

Asgeir Thor Eiriksson