Abstract: Methods and systems for operating an I/O system are disclosed. Embodiments of the present technology may include a method that involves receiving data at a NIC, caching the data at the NIC, generating a meta-identifier (meta-ID) for the data, writing the data to a host via a PCIe interface, providing the meta-ID to the host, receiving a request for a service at the NIC from the host, the request including the meta-ID, accessing the cached data in the NIC using the meta-ID, and performing the service on the cached data that was accessed in the NIC using the meta-ID.

Abstract: Described are platforms, systems, and methods for actuating transmission control protocol/Internet protocol (TCP/IP) through a method comprises: identifying a computer workload during a handshake process for establishing a network connection with a remote host; configuring, based on the computer workload, one or more TCP/IP parameters of the network connection; and completing the handshake process to establish the network connection with the remote host.

Abstract: Described are platforms, systems, and methods for processing a chain of operations through an input output (IO) subsystem without central processing unit (CPU) involvement. In one aspect, a computer-implemented method comprises: providing, via the CPU, the chain of operations to the IO subsystem, wherein the IO subsystem is coupled to the one or more processors over Peripheral Component Interconnect Express (PCIe); processing, with the IO subsystem, the chain of operations by: retrieving, from a memory, data associated with the chain of operations; executing each of the operations in the chain to determine an output based on the data and output determined for any prior executed operation in the chain; and providing the output of each the executed operations for execution of the respective next operation in the chain; and providing, via the IO subsystem, an output for the chain of operations to the CPU.

Abstract: Described are platforms, systems, and methods for providing an in-line, transparent Transmission Control Protocol (TCP)/Transport Layer Security (TLS) proxy. In one aspect, a programmable input output (IO) device comprises at least one advanced reduced instruction set computer (RISC) machine (ARM) core communicably coupled to at least one central processing unit (CPU) core of a host device; a programmable P4 pipeline comprising a cryptographic offload subsystem; and a memory unit. The programmable IO device executing instruction stored on the memory unit comprising: establishing a session for an incoming TCP connection received from a remote host via the at least one ARM core; processing data packets received from the remote host via the programmable P4 pipeline; decrypting the received data packets via the cryptographic offload subsystem; and providing the decrypted data packets to the host device.

Abstract: A multitude of data transfer queues can have data transfer operations that are scheduled for a processing circuit to perform. Some of the data transfer queues may submit so many or such large data transfer operations that others receive little or no attention. The situation can be resolved in the data plane via a processing circuit that performs the data transfer operations in conjunction with priority evaluation operations that can assign the data transfer queues to different scheduler priority classes. A scheduler can schedule data transfer operations based on the scheduler priority classes of the data transfer queues.

Abstract: Cloud services are often implemented as instances of applications having one or more components running on the nodes (e.g., host computers or servers) of a data center. Network services are thereby provided to a workload that uses the network resources of network interface devices (e.g., a NIC, switch, or router). The workload is a first instance of an application. The network interface devices can produce resource usage measurements of usage metrics that quantify usage of the network resources by the workload. The resource measurements can be used to produce an application network profile of the application. The application network profile can be used to select at least one of a plurality of nodes on which a second instance of the application is launched.

Abstract: A network appliance can queue a first packet and a second packet of a network traffic flow in an input queue of a match-action pipeline. The match-action pipeline can be implemented via a packet processing circuit of the network appliance and can be configured to process a plurality of network traffic flows. Submitting the first packet to the match-action pipeline can cause a first flow miss. The second packet can be moved to a burst queue of the network appliance and a match-action configuration can be generated based on the first packet. The second packet can be moved from the burst queue to the input queue after the match-action pipeline is configured with the match-action configuration. The match-action pipeline can then process the second packet.

Abstract: Methods and system for directing traffic flows to a fast data path or a slow data path are disclosed. Parsers can produce packet header vectors (PHVs) for use in match-action units. The PHVs are also used to generate feature vectors for the traffic flows. A flow training engine produces a classification model. Feature vectors input to the classification model result in output predictions predicting if a traffic flow will be long lived or short lived. The classification models are used by network appliances to install traffic flows into fast data paths or the slow data paths based on the predictions.

Abstract: A network appliance having a control plane and a data plane can process substantially every input packet at wire speed in a programmable packet processing pipeline of the data plane. Sensors, which can be processes implemented within the pipeline, can measure parameters of the network traffic flows and of the network appliance in accordance with monitoring policies. Reporting policies can be triggered when any one of many criteria are met by the parameters. The reporting policy can result in a report being sent to an outside recipient. Alternatively, the reporting policy can result in the network appliance implementing additional monitoring or reporting policies.

Abstract: Load balancing of NVMe targets based on real time metrics can be obtained for NAS appliances mirroring a namespace by assigning the NAS appliances to service sets that include an active load balancing set, a monitored inactive set, and an out of service set. Storage performance metrics of the NAS appliances can be tracked by monitoring IO operations for accessing a NAS mirroring the namespace in a non-volatile memory. Based on the storage metrics, NAS appliances can be moved from one of the service sets to another. Dummy IO operations can be used to track the storage performance metrics of monitored inactive NAS appliances such that a monitored inactive NAS may be moved to the active load balancing set when certain performance constraints are met.

Abstract: A configurable transaction filtering and logging circuit for on-chip communications within a semiconductor chip can store filter patterns. The filter patterns can include an address range filter pattern. The circuit can monitor transactions carried by an on-chip connection fabric. The transactions can be configured to transfer data between a first core circuit and a second core circuit that are also implemented on the semiconductor chip. The circuit can execute one of a set of actions in response to detecting a transaction that matches one of the filter patterns. One of the actions can be logging the transaction to a transaction log buffer in response to detecting that the transaction matches one of the filter patterns.

Abstract: A compressed flow log can be created from flow log entries. Flow log entries include field values for flow log fields. The entries can be compressed based on tuples (e.g., primary tuple, secondary tuple, tertiary tuple, etc.) specified by tuple definitions that specify the flow log fields in tuple content values. A first primary tuple content value can be based on a primary tuple definition and the field values of a first flow log entry included in flow log entries. A first primary tuple symbol can be associated with the first primary tuple content value. The first flow log entry can be used to create a first compressed flow log entry that includes the first primary tuple symbol. The first compressed flow log entry can be included in the compressed flow log, and the compressed flow log can be transmitted to a flow log consumer.

Abstract: A network appliance running a first firmware may roll back to that first firmware in a hitless manner during an unsuccessful upgrade to a second firmware. Before the attempted upgrade, a first process in the first firmware is providing a service. The upgrade process is initiated to upgrade the network appliance from the first firmware to a second firmware. The upgrade process can include stopping communication via a data plane of the network appliance to the first process, and detecting an upgrade failure. The upgrade process is hitless because rolling back the upgrade process occurs without halting the first firmware. Rolling back the upgrade includes restoring communications via the data plane to the first process.

Abstract: A network appliance can maintain an active set indicating active backends for a load balanced network service. To monitor the health of the backends, the network appliance can transmit a network packet to a backend that is one of the active backends in the active set and can receive a response packet responsive to the network packet. An invariant hash can be calculated from the response packet using fields that are the same when the response is a normal response (e.g. not an error response) from a healthy backend. If the packet indicates an error or is otherwise indicative of a problem, the network appliance can determine, using the invariant hash, that the response packet does not match an expected result associated with the backend. Based on the error, the number of network packets resulting in errors, etc., the backend can be removed from the active set.

Abstract: Methods and systems for managing statistics in an I/O system are disclosed. Embodiments of the present technology may include a method for managing statistical data at an I/O system, the method including reading a statistic record from an array of statistic records according to a write request that is held in a register of a register interface. In some embodiments, the write request includes a data element. In some embodiments, the array of statistic records is stored in random access memory (RAM).

Abstract: Methods and apparatuses for a programmable IO device interface are provided. The apparatus may comprise: a first memory unit having a plurality of programs stored thereon, the plurality of programs are associated with a plurality of actions comprising updating memory based data structure, inserting a DMA command or initiating an event; a second memory unit for receiving and storing a table result, and the table result is provided by a table engine configured to perform packet match operations on (i) a packet header vector contained in a header portion and (ii) data stored in a programmable match table; and circuitry for executing a program selected from the plurality of programs in response to the table result and an address received by the apparatus, and the program is executed until completion and the program is associated with the programmable match table.

Abstract: Described are programmable IO devices configured to perform operations. These operations comprise: determining a set of range-based elements for a network; sorting the set of range-based elements according to a global order among the range-based elements; generating an interval table from the sorted range-based elements; generating an interval binary search tree from the interval table; propagating data stored in subtrees of interior stages of the interval binary search tree to subtrees of a last stage of the interval binary search tree such that the interior stages do not comprise data; converting the interval binary search tree to a Pensando Tree; compressing multiple levels of the Pensando Tree into cache-lines; and assembling the cache-lines in the memory unit such that each stage can compute an address of a next-cache line to be fetched by a next stage.

Abstract: Methods and systems for memory resource allocation are disclosed. In an embodiment, a method for memory resource allocation involves reading a pool-specific configuration record from an array of memory mapped pool-specific configuration records according to a memory resource allocation request that is held in an address register of a memory mapped register interface, performing a memory resource allocation operation to service the memory resource allocation request, wherein performing the memory resource allocation operation involves interacting with a resource list according to a pointer in the pool-specific configuration record, advancing the pointer after the interaction, and updating the pointer in the pool-specific configuration record with the advanced pointer.

Abstract: A method for managing network congestion is provided. The method comprises: receiving, at a receiver, a packet comprising a timestamp provided by a first clock of a sender; deriving, by the receiver, a latency value based at least in part on the timestamp provided by the first clock and a receipt time provided by a second clock of the receiver; determining a latency change by comparing the latency value with a previous latency value; and determining a state of network congestion based at least in part on the latency change.

Abstract: Increased fairness for small vs large NVMe IO commands for accessing a non-volatile memory namespace provided by a network attached storage appliance can be realized by placing NVMe submissions received by a NVMe SQ on a first fabric queue set or a second fabric queue set based on a fairness policy. The first fabric queue set accesses the namespace via a first fabric connection. The second fabric queue set accesses the namespace via a second fabric connection. Accessing the namespace via the fabric connections results in NVMe completions that are merged from the fabric queue sets onto an NVMe completion queue. A process producing the NVMe submissions and receiving the resulting NVMe completions may be unaware of the multiple fabric queue sets.