Abstract: A configurable transaction filtering and logging circuit for on-chip communications within a semiconductor chip can store filter patterns. The filter patterns can include an address range filter pattern. The circuit can monitor transactions carried by an on-chip connection fabric. The transactions can be configured to transfer data between a first core circuit and a second core circuit that are also implemented on the semiconductor chip. The circuit can execute one of a set of actions in response to detecting a transaction that matches one of the filter patterns. One of the actions can be logging the transaction to a transaction log buffer in response to detecting that the transaction matches one of the filter patterns.

Abstract: A network appliance running a first firmware may roll back to that first firmware in a hitless manner during an unsuccessful upgrade to a second firmware. Before the attempted upgrade, a first process in the first firmware is providing a service. The upgrade process is initiated to upgrade the network appliance from the first firmware to a second firmware. The upgrade process can include stopping communication via a data plane of the network appliance to the first process, and detecting an upgrade failure. The upgrade process is hitless because rolling back the upgrade process occurs without halting the first firmware. Rolling back the upgrade includes restoring communications via the data plane to the first process.

Abstract: A network appliance can maintain an active set indicating active backends for a load balanced network service. To monitor the health of the backends, the network appliance can transmit a network packet to a backend that is one of the active backends in the active set and can receive a response packet responsive to the network packet. An invariant hash can be calculated from the response packet using fields that are the same when the response is a normal response (e.g. not an error response) from a healthy backend. If the packet indicates an error or is otherwise indicative of a problem, the network appliance can determine, using the invariant hash, that the response packet does not match an expected result associated with the backend. Based on the error, the number of network packets resulting in errors, etc., the backend can be removed from the active set.

Abstract: Methods and systems for managing statistics in an I/O system are disclosed. Embodiments of the present technology may include a method for managing statistical data at an I/O system, the method including reading a statistic record from an array of statistic records according to a write request that is held in a register of a register interface. In some embodiments, the write request includes a data element. In some embodiments, the array of statistic records is stored in random access memory (RAM).

Abstract: Methods and apparatuses for a programmable IO device interface are provided. The apparatus may comprise: a first memory unit having a plurality of programs stored thereon, the plurality of programs are associated with a plurality of actions comprising updating memory based data structure, inserting a DMA command or initiating an event; a second memory unit for receiving and storing a table result, and the table result is provided by a table engine configured to perform packet match operations on (i) a packet header vector contained in a header portion and (ii) data stored in a programmable match table; and circuitry for executing a program selected from the plurality of programs in response to the table result and an address received by the apparatus, and the program is executed until completion and the program is associated with the programmable match table.

Abstract: Described are programmable IO devices configured to perform operations. These operations comprise: determining a set of range-based elements for a network; sorting the set of range-based elements according to a global order among the range-based elements; generating an interval table from the sorted range-based elements; generating an interval binary search tree from the interval table; propagating data stored in subtrees of interior stages of the interval binary search tree to subtrees of a last stage of the interval binary search tree such that the interior stages do not comprise data; converting the interval binary search tree to a Pensando Tree; compressing multiple levels of the Pensando Tree into cache-lines; and assembling the cache-lines in the memory unit such that each stage can compute an address of a next-cache line to be fetched by a next stage.

Abstract: Methods and systems for memory resource allocation are disclosed. In an embodiment, a method for memory resource allocation involves reading a pool-specific configuration record from an array of memory mapped pool-specific configuration records according to a memory resource allocation request that is held in an address register of a memory mapped register interface, performing a memory resource allocation operation to service the memory resource allocation request, wherein performing the memory resource allocation operation involves interacting with a resource list according to a pointer in the pool-specific configuration record, advancing the pointer after the interaction, and updating the pointer in the pool-specific configuration record with the advanced pointer.

Abstract: A method for managing network congestion is provided. The method comprises: receiving, at a receiver, a packet comprising a timestamp provided by a first clock of a sender; deriving, by the receiver, a latency value based at least in part on the timestamp provided by the first clock and a receipt time provided by a second clock of the receiver; determining a latency change by comparing the latency value with a previous latency value; and determining a state of network congestion based at least in part on the latency change.

Abstract: Increased fairness for small vs large NVMe IO commands for accessing a non-volatile memory namespace provided by a network attached storage appliance can be realized by placing NVMe submissions received by a NVMe SQ on a first fabric queue set or a second fabric queue set based on a fairness policy. The first fabric queue set accesses the namespace via a first fabric connection. The second fabric queue set accesses the namespace via a second fabric connection. Accessing the namespace via the fabric connections results in NVMe completions that are merged from the fabric queue sets onto an NVMe completion queue. A process producing the NVMe submissions and receiving the resulting NVMe completions may be unaware of the multiple fabric queue sets.

Abstract: This disclosure provides methods and systems for reducing congestion in RoCEv2 networks. The method is configured to operate large-scale in data centers on traffic flowing from a sender node to a receiver node. The method described has three stages: a fast start stage, a transition stage, and a regulation stage. In the fast start stage, the sender sends data to the receiver at a fast initial rate. This may continue until the receiver observes a congestion event. When this happens, the sender reduces the data transfer rate as the method enters the transition stage. From a reduced rate, the method enters the regulation stage, where the rate is increased using a combination of a feedback control loop and an additive increase multiplicative decrease (AIMD) algorithm.

Abstract: Described are platforms, systems, and methods for upgrading firmware on a programmable input output (IO) device. In one aspect, a method executed by the programmable IO device comprises: receiving, from a north-bound entity, a request to upgrade firmware installed on at least one CPU core; disabling flow-miss traffic to the at least one CPU core; redirecting the flow-miss traffic to an off-box service; providing a configuration for the programmable IO device to the off-box service; redirecting traffic to the off-box service; upgrading the firmware installed on the at least one CPU core; upgrading at least one program running in the data plane; reprograming a forwarding state provided by the off-box service; disabling the redirection of the traffic to the off-box service; and providing, to the north-bound entity, a notification indicating a completion of the upgrade.

Abstract: Described are platforms, systems, and methods for performing queue scheduling tasks on data packet flows. In one aspect, a method comprises: retrieving a plurality of packet flows from a network stack; reconfiguring the retrieved packet flows into per-flow queues; and performing one or more queue scheduling tasks on the per-flow queues.

Abstract: Methods and systems for exporting network information from an exporter to a collector are disclosed. Embodiments of the present technology may include updating a non-key field of a flow entry in a flow cache that corresponds to a flow, setting a field in a context-bitmap of the flow entry in response to updating the non-key field of the flow entry, identifying an export policy using the context-bitmap, and exporting information related to the flow to a collector according to the export policy.

Abstract: An authorization method using provisioned certificates is disclosed. The method includes writing security attributes to fields within a certificate and issuing the certificate to a software application on a principal node. The software application requests to perform actions on one or more resources on a resource node, sending one or more action requests along with a copy of its certificate. The resource node has an agent which verifies the permissions from the certificate and routes the request to its designated resource. The resource node returns one or more messages to the principal node, verifying whether or not complete the requests.

Abstract: Described are devices, systems, and methods for improving network security by providing network interface devices communicatively coupled to end-point-protection platforms (EPP) based on integration of two different technologies (e.g., smart NICs and EPP software) allowing each to automatically signal the other and implement automated protection mechanisms to isolate or protect a host, a virtual machine, and/or a container.

Abstract: Methods and network interface modules for processing packet headers are provided. The method comprises: receiving a packet comprising a header and a payload; generating, using the header, an initial packet header vector (PHV); providing the initial PHV to a pipeline comprising a plurality of processing stages; and processing the initial PHV in the pipeline, wherein the processing comprises, for a current processing stage in the plurality of processing stages: receiving, by the current processing stage, an input PHV, wherein the input PHV (i) is the initial PHV or a modified version of the initial PHV and (ii) comprises one or more flits, and applying a feature to the input PHV to generate an output PHV, including increasing an initial length of the input PHV if the initial length is not sufficient to apply the feature.

Abstract: Methods and systems for upgrading an intelligent server adapter (ISA) with reduced downtime that affects performance are provided. The method includes, from a main agent, initiating a backup agent that includes critical functions of the ISA and runs in a tight loop, isolated from other components. The main agent transfers critical duties to the backup agent and shuts down before performing the upgrade. After upgrading itself and other system components, the main agent retrieves the duties from the backup agent, and may terminate the backup agent.

Abstract: Described herein are baffles for Input/Output (I/O) devices and I/O devices comprising baffles configured to redirect incoming pre-heated air around downstream electrical components and/or their respective heat sinks to prevent overheating. Providing an isolated fresh airflow path from a fluid inlet to such downstream electrical devices reducing such overheating, which prevents malfunctions and increases the I/O efficiency, speed, and lifetime of I/O devices.