Abstract: Embodiments of apparatus, computer-implemented methods, systems, and computer-readable media are described herein for a virtual machine manager, wherein the virtual machine manager is configured to selectively employ different views with different permissions to map guest physical memory of a virtual machine of the apparatus to host physical memory of the apparatus, to regulate access to and protect different portions of an application of the virtual machine that resides in different portions of the physical memory. Other embodiments may be described and/or claimed.

Abstract: The present disclosure provides systems and methods for hardware-enforced protection from malicious software. A device may include at least a security validator module and a security initiator module. A call from a process requesting access to information stored in the device may be redirected to the security initiator module, which may cause the device to change from an unsecured view to a secured view. In the secured view the security validator module may determine whether the call came from malicious software. If the call is determined to be valid, then access to the stored information may be permitted. If the call is determined to be invalid (e.g., from malware), the security software may cause the device to return to the unsecured view without allowing the stored information to be accessed, and may take further measures to identify and/or eliminate process code associated with the process that made the invalid call.

Abstract: A method and device for monitoring calls to an application program interface (API) function includes monitoring for a memory permission violation of a computing device caused by the API function call. If a memory permission violation occurs, control of the computing device is transferred to a virtual machine monitor to intervene prior to execution or the API function. The virtual machine monitor may perform one or more actions in response to the API function call.

Abstract: Embodiments of apparatus, computer-implemented methods, systems, and computer-readable media are described herein for a virtual machine manager, wherein the virtual machine manager is configured to selectively employ different views with different permissions to map guest physical memory of a virtual machine of the apparatus to host physical memory of the apparatus, to regulate access to and protect different portions of an application of the virtual machine that resides in different portions of the physical memory. Other embodiments may be described and/or claimed.

Abstract: Techniques to store entries so that minimal sequential memory accesses are used to determine all relevant entries. Entries may be grouped into blocks. The order of entries within blocks may be set in a manner so that entry locations can be determined using an input value, such as a destination address. Blocks may be ordered into levels. Blocks of each level may be stored in consecutive storage locations. Accordingly, entry locations may be determined and retrieved with minimal sequential memory accesses by storing entries in a predetermined manner.

Abstract: Techniques are described herein that may be used to invalidate all entries in a table. For example, the table may be a flow cache. For example, an expiry time may be associated with one or more entries in the table. The expiry time of an entry may be initially set to the sum of the system time, the expiry time of the protocol associated with the entry, and a global time variable. To check if the entry is expired at any time, the current system time may be added to the global time variable and if the result is greater than the expiry time in the entry, then the entry is expired. To invalidate all the entries, the global time variable may be incremented by a large amount which may equal the maximum expiry time of all protocols. This may cause all entries to expire. New entries may be added using the new incremented value of the global time variable and will hence not expire.

Abstract: Techniques are described herein that may be used to invalidate all entries in a table. For example, the table may be a flow cache. For example, an expiry time may be associated with one or more entries in the table. The expiry time of an entry may be initially set to the sum of the system time, the expiry time of the protocol associated with the entry, and a global time variable. To check if the entry is expired at any time, the current system time may be added to the global time variable and if the result is greater than the expiry time in the entry, then the entry is expired. To invalidate all the entries, the global time variable may be incremented by a large amount which may equal the maximum expiry time of all protocols. This may cause all entries to expire. New entries may be added using the new incremented value of the global time variable and will hence not expire.

Abstract: A method and apparatus to route information in a network is described. A technique is described to search for routine information that uses a first technique on at least a portion of a first value of a network address and a second technique on at least a portion of a second section of an address. In particular, the first value is associated with an aggregation identifier, and compared to a unique prefix. In this way, address identifiers may be generated, and this identifier is used to search for routing information.

Abstract: According to some embodiments, a portion of local memory allocated to a thread by a programming statement includes an indication of a read/write status of the portion and symbolically references a buffer name wherein the symbolically referenced buffer name includes both letters and numbers.

Abstract: A method and apparatus to perform network routing using an improved routing table, search algorithm and update algorithm are described.

Abstract: According to some embodiments, a symbolic programming system is provided to facilitate the use of buffers stored in a local cache at a network processing element.

Abstract: Techniques to store entries so that minimal sequential memory accesses are used to determine all relevant entries. Entries may be grouped into blocks. The order of entries within blocks may be set in a manner so that entry locations can be determined using an input value, such as a destination address. Blocks may be ordered into levels. Blocks of each level may be stored in consecutive storage locations. Accordingly, entry locations may be determined and retrieved with minimal sequential memory accesses by storing entries in a predetermined manner.

Abstract: A method and apparatus to perform network routing using an improved routing table, search algorithm and update algorithm are described.

Abstract: A method and apparatus to route information in a network is described.