Intel Corporation

Manasi Deval

Parthasarathy Sarangam

Gregory J Bowers

Rajesh M Sankaran

Kun Tian

Sanjay Kumar

Utkarsh Y Kakaiya

Philip R Lantz

Nrupal R Jani

Kiran A Patil

Mitu Aggarwal

Linden Cornett

Anjali Singhai Jain

Neerav Parikh

Anil Vasudevan

Eliel Louzoun

Yadong Li

Noam Elati

Hormuzd M Khosravi

Hsin-Yuo Liu

Cong Li

Patrick Fleming

Anjaneya Reddy Chagam Reddy

Eric K Mann

Muralidhar Rajappa

Stephen Doyle

Ramkumar Nagappan

Suhail Ahmed

Ryan E Hall

Jim Daubert

David Wescott

Raed Kanjo

Alexander H Duyck

Eliezer Tamir

Ben-Zion Friedman

Russell Jerome Fenger

Sanjay Bakshi

Robert O Sharp

Rajeev D Muralidhar

Erik J Johnson

Chih-Jen Chang

Amol Kulkarni

Shriharsha S Hegde

Santosh Balakrishnan

Naru Dames Sundar

Elazar Cohen

Joshua A Hay

Kevin C Scott

Maciej Machnikowski

Padma Akkiraju

Chinh T Cao

Alexander Nguyen

Pugi Tang

Natalia Wochtman

Joanna Muniak

Shaul Yifrach

Sanjay K Kumar

Technologies for accelerated QUIC packet processing include a computing device having a network controller. The computing device programs the network controller with an encryption key associated with a QUIC protocol connection. The computing device may pass a QUIC packet to the network controller, which encrypts a payload of the QUIC packet using the encryption key. The network controller may segment the QUIC packet into multiple segmented QUIC packets before encryption. The network controller transmits encrypted QUIC packets to a remote host. The network controller may receive encrypted QUIC packets from a remote host. The network controller decrypts the encrypted payload of received QUIC packets and may evaluate an assignment function with an entropy source in the received QUIC packets and forward the received QUIC packets to a receive queue based on the assignment function. Each receive queue may be associated with a processor core. Other embodiments are described and claimed.

Technologies for accelerated QUIC packet processing with hardware offloads

Technologies for accelerated HTTP message processing include a computing device having a network controller. The computing device may generate an HTTP message, frame the HTTP message to generate a transport protocol packet such as a TCP/IP packet or QUIC packet, and pass the transport protocol packet to the network controller. The network controller compresses the HTTP header of the HTTP message, encrypts the compressed HTTP message, and transmits the encrypted message to a remote device. The network controller may segment the transport protocol packet into multiple segmented packets. The network controller may receive transport protocol packets that include encrypted HTTP message. The network controller decrypts the encrypted HTTP message to generate a compressed HTTP message, decompresses the HTTP message, and steers the HTTP message to a receive queue based on contents of an HTTP header. The network controller may coalesce multiple transport protocol packets. Other embodiments are described and claimed.

Technologies for accelerated HTTP processing with hardware acceleration

Embodiments include a method of opening a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) socket on a computing platform, initializing QUIC packet processing of a hardware-based offloader, opening a QUIC connection to the offloader, and transmitting a first QUIC packet to the offloader over the QUIC connection. The hardware-based offloader encrypts and transmits the QUIC packet.

Quick user datagram protocol (UDP) internet connections (QUIC) packet offloading

Flexible schemes for adding rules to a NIC pipeline and associated apparatus. Multiple match-action tables are implemented in host memory of a platform defining actions to be taken for matching packet flows. A packet processing pipeline and an exact match (EM) cache is implemented on a network interface, such as a NIC, installed in the platform. A portion of the match-action entries in the host memory match-action tables are cached in the EM cache. Received packets are processed to generate a key that is used as a lookup for the EM cache. If a match is found, the action is taken. For a miss, the key is forwarded to the host software and the match-action tables are searched. For a match, the action is taken, and the entry is added to the EM cache. If no match is found, a new match-action entry is added to a match-action table. Aging-out mechanisms are used for the match-action tables and the EM cache. A multi-hash scheme is used to that supports a very large number of match-action entries.

Flexible scheme for adding rules to a NIC pipeline

Technologies for protocol-agnostic network packet segmentation includes determining whether a size of a payload of a network packet to be transmitted by the compute device exceeds a maximum size threshold and segmenting the payload into a plurality of segmented payloads if the size of the payload exceeds the maximum size of threshold. The payload may be segmented based on segmentation metadata associated with the network packet.

Technologies for protocol-agnostic network packet segmentation

Examples may include a method of instantiating a virtual machine, instantiating a virtual device to transmit data to and receive data from assigned resources of a shared physical device; and assigning the virtual device to the virtual machine, the virtual machine to transmit data to and receive data from the physical device via the virtual device.

Virtual device composition in a scalable input/output (I/O) virtualization (S-IOV) architecture

An apparatus, a method, and a computer program for generating data packets according to a transport protocol from an application buffer comprising a plurality of data streams is provided. The apparatus comprises an input circuit configured to receive metadata comprising at least one of information about data packet types supported by the transport protocol, information about an offset and a length of the supported data packet types, and information about possible stream header start positions, possible payload start positions and possible offsets in the data streams. Further, the apparatus comprises a parsing circuit configured to identify offsets in an application buffer as possible segmentation points based on the metadata, to segment the application buffer at the possible segmentation points into segments for data packets, and to generate data packets according to the transport protocol based on the segments. Furthermore, an apparatus, a method and a computer program for processing the application buffer is provided.

Concept for segmenting an application buffer into data packets

Disclosed is a mechanism maintain flow rate limits to flows in a server operating in a single root input/output virtualization (SR-IOV) environment. A transmit pipeline assigns a dedicated transmit queue to a flow. A scheduler allocates a flow transmit bandwidth to the dedicated transmit queue to enforce the flow rate limit. The transmit pipeline assigns the dedicated transmit queue to the flow upon receiving a packet of the flow. A queue identifier (ID) for the dedicated transmit queue is forwarded to a tenant process acting as a source of the flow to support forwarding of packets of the flow to the proper transmit queue. The transmit pipeline maintains security by comparing packet destinations of packets with the destination of the flow associated with the dedicated transmit queue. Packets in the dedicated destination queue with destinations that do not match the flow destination may be dropped.

Flow based rate limit

Packets received non-contiguously from a network are processed by a network interface controller by coalescing received packet payload into receive buffers on a receive buffer queue and writing descriptors associated with the receive buffers for a same flow consecutively in a receive completion queue. System performance is optimized by reusing a small working set of provisioned receive buffers to minimize the memory footprint of memory allocated to store packet data. The remainder of the provisioned buffers are in an overflow queue and can be assigned to the network interface controller if the small working set of receive buffers is not sufficient to keep up with the received packet rate. The receive buffer queue can be refilled based on either timers or when the number of buffers in the receive buffer queue is below a configurable low watermark.

Apparatus and method for buffer management for receive segment coalescing

Examples described herein identify a flow that is considered heavy or high in transmit or receive rate. A filter rule can be assigned to the flow such that packets of the heavy flow are allocated to a queue and core for processing. Various queues and cores can be dedicated to processing received or transmitted packets of heavy flows and various queues and cores can be dedicated to process received or transmitted packets of non-heavy flows. An application acceleration layer can be used to migrate an application to a core that is to process received or transmitted packets of a heavy flow.

Allocation of processors for processing packets

Examples may include a computing platform having a host driver to get a packet descriptor of a received packet stored in a receive queue and to modify the packet descriptor from a first format to a second format. The computing platform also includes a guest virtual machine including a guest driver coupled to the host driver, the guest driver to receive the modified packet descriptor and to read a packet buffer stored in the receive queue using the modified packet descriptor, the packet buffer corresponding to the packet descriptor.

Zero copy host interface in a scalable input/output (I/O) virtualization (S-IOV) architecture

Examples include a method of live migrating a virtual device by creating a virtual device in a virtual machine, creating first and second interfaces for the virtual device, transferring data over the first interface, detecting a disconnection of the virtual device from the virtual machine, switching data transfers for the virtual device from the first interface to the second interface, detecting a reconnection of the virtual device to the virtual machine, and switching data transfers for the virtual device from the second interface to the first interface.

Live migration of virtual devices in a scalable input/output (I/O) virtualization (S-IOV) architecture

Examples may include a method of protecting memory and I/O transactions. The method includes allocating memory for an application, assigning a resource of a physical device to the application, assigning a process address space identifier to the assigned resource, creating a security enclave to protect the allocated memory of the application, and associating the security enclave with the process address space identifier to protect the allocated memory and the assigned resource.

Memory enclaves using process address space identifiers in a scalable input/output (I/O) virtualization (S-IOV) architecture

Growing community of inventors

Portland, OR, United States of America

Manasi Deval