Intel Corporation

Linden Minnick

Patrick L Connor

Avraham Mualem

Lucas M Jenison

Benny Eitan

William P Campbell

Roy Callum

Moshe Valenci

Numerous embodiments of a method and apparatus for processing latency sensitive electronic data with interrupt moderation are disclosed.

Method and apparatus for processing latency sensitive electronic data with interrupt moderation

Apparatus, systems, and methods to manage networks may operate to receive a packet into an element of an array contained in a memory while a low resource state exists, and to truncate the array at the element responsive to at least one of an indication that the array is full, or an indication that no more packets are available to be received after receiving at least the packet. The receiving and the truncating may be executed by a processor. Additional apparatus, systems, and methods are disclosed.

Data reception management apparatus, systems, and methods

Computer network apparatus may include a packet-receiving module to receive a packet into an element of a storage array while a low resource state exists, an array truncation module to truncate the array at the element when the array is full or when no more packets are available to be received, and an array indication module to indicate the array after the array truncation module truncates the array. In one embodiment, a system may include a receiving node containing the apparatus. A method may include receiving a packet into an element of an array while a low resource state exists, truncating the array at the element after the array is full or no more packets are available to be received, and indicating the array.

Methods and apparatuses for synchronizing the exchange of cryptography information between kernel drivers. A high level application in an electronic system passes a pointer to a base driver. The pointer is a unique identifier for cryptography information, such as a Security Association (SA), that the base driver uses to populate a cryptography information table for performing cryptography operations on secure traffic data packets. If the network interface device and/or its associated driver are reset, the pointer is used to repopulate the cryptography information table with specific cryptography information needed to perform cryptography operations on the data packets.

Synchronizing the exchange of cryptography information between kernel drivers

The present disclosure describes a method comprising issuing a plurality of commands to a controller, wherein the commands are issued in a first order, and wherein the completion status of commands is written to the memory in a second order, and wherein the second order may be different from the first order. Also described is an apparatus comprising a controller adapted to accept a plurality of commands, wherein the commands are issued in a first order, and completion status of commands is written to the memory in a second order, and wherein the second order may be different from the first order.

Method for indicating completion status of asynchronous events

Methods and apparatuses for managing tables of security associations (SA) are described. A device driver operating in an environment, for example, NDIS, where a unique handle is selected for each transmit SA and the SPI for each receive SA is selected with a random algorithm, divides transmit SAs from receive SAs in separate tables. An SA lookup table having a whole binary number of entries that is the lowest binary number greater than five times the number of SAs supported by the device driver contains information to match an SA to a data packet, and locate the SA in memory. The lookup table is searched using a bit-wise AND hash function.

Security association management through the use of lookup tables

A Security Association (SA) lookup table is maintained at a network interface. The SA data is stored in a memory external to the network interface, for example, in the memory of a host electronic system in which the network interface provides network access. The lookup table stores sufficient information for the network interface, or another system component, to access the SA data. When a cryptography operation is to be performed, the SA data is retrieved from the external memory and delivered to the processor performing the cryptographic operations. In one embodiment, destination Internet Protocol (IP) address and the IPSec protocol are checked after the SA data is retrieved from the external memory. In one embodiment, the lookup table entries contain only an offset value from a base address value to locate the SA data.

Techniques for storing and retrieving security information corresponding to cryptographic operations to support cryptographic processing for multiple network traffic streams

A system for improved decryption performance includes a computer in electronic communication with an encrypted network. A controller performs a decryption operation on an encrypted packet received from the network, and the computer asserts an interrupt prior to the system completing transfer of the decrypted packet back to host memory to reduce the additional latency a packet suffers during Secondary Use. An additional interrupt may be asserted after the Secondary Use operation is complete, to ensure that the Secondary Use packet is processed. A method for improving decryption performance similarly includes asserting an interrupt prior to the complete transfer of a decrypted packet from a controller back to host memory during Secondary Use. The method may further include asserting an additional interrupt after the Secondary Use operation is complete, to ensure that the Secondary Use packet is processed.

Internet protocol security decryption with secondary use speculative interrupts

A method, apparatus, and article of manufacture for retaining packet order in multiprocessor systems utilizing multiple transmit queues while minimizing spinlocks are disclosed herein. Embodiments of the present invention define multiple transmit queues for a given priority level of packets to allow parallel processing and queuing of packets having equal priority in different transmit queues. Queuing packets of equal priority in different transmit queues minimizes processor time spent attempting to acquire queue-specific resources associated with one particular transmit queue. In addition, embodiments of the present invention provide an assignment mechanism to maximize utilization of the multiple transmit queues by queuing packets corresponding to each transmit request in a next available transmit queue defined for a given priority level. Coordination between hardware and software allows the order of the queued packets to be maintained in the transmission process.

Method and apparatus for minimizing spinlocks and retaining packet order in systems utilizing multiple transmit queues

Cryptographic operations are performed on data packets received by an electronic system. To improve system performance, incoming packets are associated with a security association and offloaded to dedicated crypto functions, such as Inline Receive or other available, alternative crypto-processing functions. In one embodiment, when Inline Receive is busy or is otherwise unavailable, a most efficient crypto function from alternative processing functions is selected as a function of the security-associated packets to perform crypto operations on an offloaded packet. Various methods, systems, apparatus, and articles comprising a machine-readable medium are also described.

Methods and apparatus to perform cryptographic operations on received data

A method and apparatus for intelligently determining which traffic streams to offload efficiently. A metric value is associated with a Security Association (SA) for each network traffic stream coupled to an electronic system. The metric is used to determine which of multiple methods to perform cryptography operations should be used to handle which streams. The metric is modified based on network traffic, and increased when the SA is cached. The metric of all SAs is periodically decreased. In one embodiment, a network interface driver determines which SAs should be cached on a network interface card and handled using Inline Receive, and which SAs should not be cached and handled using Secondary Use. Cached SAs are replaced by non-cached SAs only if the metric value of a non-cached SA is greater than the metric value of a cached SA by at least a predetermined amount representing the cost of cache replacement.

Intelligently determining which traffic streams to offload efficiently

Methods, apparatus, and articles of manufacture for retaining packet order in multiprocessor systems utilizing multiple transmit queues are disclosed herein. Embodiments of the present invention define multiple transmit queues for a given priority level of packets to enable the multiprocessor system to process and queue packets of equal priority in different transmit queues. Queuing packets of equal priority in different transmit queues minimizes processor time spent attempting to acquire queue-specific resources associated with one particular transmit queue. In addition, embodiments of the present invention provide an assignment mechanism to ensure that packets corresponding to a common flow are queued in the same transmit queue in order to eliminate, to the extent possible, out-or-order packets, which many times results in lost packets and a reduction in realized network throughput.

Methods and apparatus for retaining packet order in systems utilizing multiple transmit queues

Two timers are used to improve ingress throughput. Decisions to transfer the ingress packets are made based on when the two timers expire. A first timer is used to time how long a first ingress packet waits before it is transferred. When this first timer expires, the all received ingress packets including the first ingress packet are transferred. A second timer is used to time how long to wait for a new ingress packet to be received. The second timer is reset if a new ingress packet is received before expiration of the second timer. When the second timer expires and no new ingress packet is received during the wait, all received ingress packets including the first ingress packet are transferred.

Methods and apparatus for determination of packet sizes when transferring packets via a network

In one embodiment, an apparatus is described. The apparatus includes an input/output (I/O) device that is capable of being coupled to a computing system. The device is configured such that, in operation, the I/O device has the capability to interrupt an associated computing system processor based at least in part on a comparison of a threshold value with the quantity of transmit resources available to the I/O device.

Growing community of inventors

Hillsboro, OR, United States of America

Linden Minnick