Abstract: Distributed computing systems, devices, and associated methods of packet processing are disclosed herein. One example method includes receiving a packet having a header with a protocol field, a source address field, a source port field, a destination address field, and a destination port field individually containing a corresponding value. The method also includes extracting the values of the protocol field, the source address field, the source port field, the destination field, and the destination port field, determining whether a first match action table (“MAT”) contains an entry indexed to the extracted values, and in response to determining that the first MAT does not contain an entry indexed to the extracted values, using a subset of the extracted values to identify an entry in a second MAT.

Abstract: Embodiments include a method of opening a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) socket on a computing platform, initializing QUIC packet processing of a hardware-based offloader, opening a QUIC connection to the offloader, and transmitting a first QUIC packet to the offloader over the QUIC connection. The hardware-based offloader encrypts and transmits the QUIC packet.

Abstract: Flexible schemes for adding rules to a NIC pipeline and associated apparatus. Multiple match-action tables are implemented in host memory of a platform defining actions to be taken for matching packet flows. A packet processing pipeline and an exact match (EM) cache is implemented on a network interface, such as a NIC, installed in the platform. A portion of the match-action entries in the host memory match-action tables are cached in the EM cache. Received packets are processed to generate a key that is used as a lookup for the EM cache. If a match is found, the action is taken. For a miss, the key is forwarded to the host software and the match-action tables are searched. For a match, the action is taken, and the entry is added to the EM cache. If no match is found, a new match-action entry is added to a match-action table. Aging-out mechanisms are used for the match-action tables and the EM cache. A multi-hash scheme is used to that supports a very large number of match-action entries.

Abstract: An apparatus, a method, and a computer program for generating data packets according to a transport protocol from an application buffer comprising a plurality of data streams is provided. The apparatus comprises an input circuit configured to receive metadata comprising at least one of information about data packet types supported by the transport protocol, information about an offset and a length of the supported data packet types, and information about possible stream header start positions, possible payload start positions and possible offsets in the data streams. Further, the apparatus comprises a parsing circuit configured to identify offsets in an application buffer as possible segmentation points based on the metadata, to segment the application buffer at the possible segmentation points into segments for data packets, and to generate data packets according to the transport protocol based on the segments.

Abstract: Technologies for protocol-agnostic network packet segmentation includes determining whether a size of a payload of a network packet to be transmitted by the compute device exceeds a maximum size threshold and segmenting the payload into a plurality of segmented payloads if the size of the payload exceeds the maximum size of threshold. The payload may be segmented based on segmentation metadata associated with the network packet.

Abstract: Examples may include a method of instantiating a virtual machine, instantiating a virtual device to transmit data to and receive data from assigned resources of a shared physical device; and assigning the virtual device to the virtual machine, the virtual machine to transmit data to and receive data from the physical device via the virtual device.

Abstract: An apparatus, a method, and a computer program for generating data packets according to a transport protocol from an application buffer comprising a plurality of data streams is provided. The apparatus comprises an input circuit configured to receive metadata comprising at least one of information about data packet types supported by the transport protocol, information about an offset and a length of the supported data packet types, and information about possible stream header start positions, possible payload start positions and possible offsets in the data streams. Further, the apparatus comprises a parsing circuit configured to identify offsets in an application buffer as possible segmentation points based on the metadata, to segment the application buffer at the possible segmentation points into segments for data packets, and to generate data packets according to the transport protocol based on the segments.

Abstract: Embodiments include a method of opening a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) socket on a computing platform, initializing QUIC packet processing of a hardware-based offloader, opening a QUIC connection to the offloader, and transmitting a first QUIC packet to the offloader over the QUIC connection. The hardware-based offloader encrypts and transmits the QUIC packet.

Abstract: Technologies for accelerated QUIC packet processing include a computing device having a network controller. The computing device programs the network controller with an encryption key associated with a QUIC protocol connection. The computing device may pass a QUIC packet to the network controller, which encrypts a payload of the QUIC packet using the encryption key. The network controller may segment the QUIC packet into multiple segmented QUIC packets before encryption. The network controller transmits encrypted QUIC packets to a remote host. The network controller may receive encrypted QUIC packets from a remote host. The network controller decrypts the encrypted payload of received QUIC packets and may evaluate an assignment function with an entropy source in the received QUIC packets and forward the received QUIC packets to a receive queue based on the assignment function. Each receive queue may be associated with a processor core. Other embodiments are described and claimed.

Abstract: Disclosed is a mechanism maintain flow rate limits to flows in a server operating in a single root input/output virtualization (SR-IOV) environment. A transmit pipeline assigns a dedicated transmit queue to a flow. A scheduler allocates a flow transmit bandwidth to the dedicated transmit queue to enforce the flow rate limit. The transmit pipeline assigns the dedicated transmit queue to the flow upon receiving a packet of the flow. A queue identifier (ID) for the dedicated transmit queue is forwarded to a tenant process acting as a source of the flow to support forwarding of packets of the flow to the proper transmit queue. The transmit pipeline maintains security by comparing packet destinations of packets with the destination of the flow associated with the dedicated transmit queue. Packets in the dedicated destination queue with destinations that do not match the flow destination may be dropped.

Abstract: Technologies for accelerated QUIC packet processing include a computing device having a network controller. The computing device programs the network controller with an encryption key associated with a QUIC protocol connection. The computing device may pass a QUIC packet to the network controller, which encrypts a payload of the QUIC packet using the encryption key. The network controller may segment the QUIC packet into multiple segmented QUIC packets before encryption. The network controller transmits encrypted QUIC packets to a remote host. The network controller may receive encrypted QUIC packets from a remote host. The network controller decrypts the encrypted payload of received QUIC packets and may evaluate an assignment function with an entropy source in the received QUIC packets and forward the received QUIC packets to a receive queue based on the assignment function. Each receive queue may be associated with a processor core. Other embodiments are described and claimed.

Abstract: Technologies for accelerated HTTP message processing include a computing device having a network controller. The computing device may generate an HTTP message, frame the HTTP message to generate a transport protocol packet such as a TCP/IP packet or QUIC packet, and pass the transport protocol packet to the network controller. The network controller compresses the HTTP header of the HTTP message, encrypts the compressed HTTP message, and transmits the encrypted message to a remote device. The network controller may segment the transport protocol packet into multiple segmented packets. The network controller may receive transport protocol packets that include encrypted HTTP message. The network controller decrypts the encrypted HTTP message to generate a compressed HTTP message, decompresses the HTTP message, and steers the HTTP message to a receive queue based on contents of an HTTP header. The network controller may coalesce multiple transport protocol packets. Other embodiments are described and claimed.

Abstract: Packets received non-contiguously from a network are processed by a network interface controller by coalescing received packet payload into receive buffers on a receive buffer queue and writing descriptors associated with the receive buffers for a same flow consecutively in a receive completion queue. System performance is optimized by reusing a small working set of provisioned receive buffers to minimize the memory footprint of memory allocated to store packet data. The remainder of the provisioned buffers are in an overflow queue and can be assigned to the network interface controller if the small working set of receive buffers is not sufficient to keep up with the received packet rate. The receive buffer queue can be refilled based on either timers or when the number of buffers in the receive buffer queue is below a configurable low watermark.

Abstract: Technologies for accelerated HTTP message processing include a computing device having a network controller. The computing device may generate an HTTP message, frame the HTTP message to generate a transport protocol packet such as a TCP/IP packet or QUIC packet, and pass the transport protocol packet to the network controller. The network controller compresses the HTTP header of the HTTP message, encrypts the compressed HTTP message, and transmits the encrypted message to a remote device. The network controller may segment the transport protocol packet into multiple segmented packets. The network controller may receive transport protocol packets that include encrypted HTTP message. The network controller decrypts the encrypted HTTP message to generate a compressed HTTP message, decompresses the HTTP message, and steers the HTTP message to a receive queue based on contents of an HTTP header. The network controller may coalesce multiple transport protocol packets. Other embodiments are described and claimed.

Abstract: A computer implemented method includes receiving partially created software defined network (SDN) policy state information at a backup software defined network (SDN) appliance in response to the sending of a synchronize packet to establish a connection. The state information corresponds to a state of the connection between two endpoints that include a first active SDN appliance and a second active SDN appliance. A replica of the SDN policy state information is saved at the backup SDN appliance. An update to the SDN policy state information is received in response to the sending of an acknowledgement packet. The replica of the SDN policy state information updated at the backup SDN appliance to enable the backup SDN to transition to active.

Abstract: Examples described herein identify a flow that is considered heavy or high in transmit or receive rate. A filter rule can be assigned to the flow such that packets of the heavy flow are allocated to a queue and core for processing. Various queues and cores can be dedicated to processing received or transmitted packets of heavy flows and various queues and cores can be dedicated to process received or transmitted packets of non-heavy flows. An application acceleration layer can be used to migrate an application to a core that is to process received or transmitted packets of a heavy flow.

Abstract: Distributed computing systems, devices, and associated methods of packet processing are disclosed herein. One example method includes receiving a packet having a header with a protocol field, a source address field, a source port field, a destination address field, and a destination port field individually containing a corresponding value. The method also includes extracting the values of the protocol field, the source address field, the source port field, the destination field, and the destination port field, determining whether a first match action table (“MAT”) contains an entry indexed to the extracted values, and in response to determining that the first MAT does not contain an entry indexed to the extracted values, using a subset of the extracted values to identify an entry in a second MAT.

Abstract: Examples may include a computing platform having a host driver to get a packet descriptor of a received packet stored in a receive queue and to modify the packet descriptor from a first format to a second format. The computing platform also includes a guest virtual machine including a guest driver coupled to the host driver, the guest driver to receive the modified packet descriptor and to read a packet buffer stored in the receive queue using the modified packet descriptor, the packet buffer corresponding to the packet descriptor.

Abstract: Examples may include a method of protecting memory and I/O transactions. The method includes allocating memory for an application, assigning a resource of a physical device to the application, assigning a process address space identifier to the assigned resource, creating a security enclave to protect the allocated memory of the application, and associating the security enclave with the process address space identifier to protect the allocated memory and the assigned resource.

Abstract: Examples include a method of live migrating a virtual device by creating a virtual device in a virtual machine, creating first and second interfaces for the virtual device, transferring data over the first interface, detecting a disconnection of the virtual device from the virtual machine, switching data transfers for the virtual device from the first interface to the second interface, detecting a reconnection of the virtual device to the virtual machine, and switching data transfers for the virtual device from the second interface to the first interface.