Abstract: The throughput of a network appliance can be increased by a circuit that produces an encrypted block and a digest value while requiring only a single read of a data block. Data blocks, including a first data block, are stored in a memory that can be accessed by an ASIC that includes an encryption offload circuit. The ASIC can read the first data block from the memory and the encryption offload circuit can produce a first encrypted block and a first digest value from the first data block. The ASIC can produce a network packet that includes the first encrypted block and a data digest value. The first digest value is used to produce the data digest value, and a single read of the first data block from the memory is performed for producing the first encrypted block and also for calculating the first digest value.

Abstract: Methods and systems for implementing traffic mirroring for network telemetry are disclosed. An embodiment of a method for implementing traffic mirroring for network telemetry involves identifying network traffic at a network appliance that is to be subjected to traffic mirroring for network telemetry, and selecting from available options of transmitting enhanced mirrored network traffic from the network appliance to a collector, wherein the enhanced mirrored network traffic is generated at the network appliance by at least one of compressing and encrypting the network traffic, and transmitting mirrored network traffic from the network appliance to the collector without compressing or encrypting the network traffic.

Abstract: InfiniBand transport protocol today supports RDMA operations such as read and write with each operation having an opcode defined in the InfiniBand standard. Currently, new RDMA operations require extending the transport protocol by defining a new opcode, its respective header and enhancing InfiniBand implementations to support this new behavior. A more robust way of extending RDMA without requiring an expanding set of opcodes is to register computer code by associating it with a code key similar to a memory key. An InfiniBand channel adapter receiving an RDMA request that includes a code key executes the associated computer code, perhaps compiling it first, in response to receiving the RDMA request. The RDMA response returned to the requester includes an execution result indicating an outcome of executing the executable computer code.

Abstract: The InfiniBand transport protocol supports the concept of a SRQ (shared receive queue) by which multiple QPs (queue pairs) can share the same receive queue resources. According to the InfiniBand Specification, when a SRQ is enabled, flow control needs to be disabled. The lack of flow control mechanism results in there being no fairness guarantees across multiple requesters. Fairness across requesters can be obtained by implementing a SRQ configured to receive request messages from requesters initiating transactions that consume WQEs (work queue elements) of the SRQ, monitoring consumption of the WQEs by the requesters, determining that a requester has a WQE consumption exceeding a policing threshold, and in response to determining that the WQE consumption of the requester exceeds the policing threshold, sending a response message to the requester that results in reducing the WQE consumption of the requester.

Abstract: Virtual functions (VFs) running on SR-IOV (single root IO virtualization) capable PCIe devices can migrate in association with VMs using the VFs. A SR-IOV capable PCIe device installed in a host computer can implement the VFs. A VM running on the host and associated with the VF can use the VF to obtain a service such as network communications or access to a NAS device. Migrating the VF in association with the VM can include halting the VM in a VM state on the host, halting the VF in a PCIe state and then obtaining a PCIe state data, restarting the VF in the PCIe state on a second PCIe device of a second host based on the PCIe state data, and restarting the VM in the VM state on the second host, wherein the VM is configured to use the VF on the second PCIe device.

Abstract: Methods and systems for implementing traffic mirroring for network telemetry are disclosed. An embodiment of a method for implementing traffic mirroring for network telemetry involves identifying network traffic at a network appliance that is to be subjected to traffic mirroring for network telemetry, and selecting from available options of transmitting enhanced mirrored network traffic from the network appliance to a collector, wherein the enhanced mirrored network traffic is generated at the network appliance by at least one of compressing and encrypting the network traffic, and transmitting mirrored network traffic from the network appliance to the collector without compressing or encrypting the network traffic.

Abstract: SR-IOV (single root IO virtualization) capable PCIe devices can implement virtual functions (VFs) that are assigned to VMs running on a host machine, thereby speeding IO operation by writing directly to the VMs' memory while bypassing the hypervisor managing the VMs. As such, VFs thwart the dirty page tracking that hypervisors use to minimize VM downtime when the VM is migrated between hosts. The SR-IOV PCIe devices can help resolve this problem by maintaining dirty page tracking data for VMs running on the host machine. The SR-IOV PCIe devices bypassing the hypervisor while writing into a memory page of the VM can set the dirty page tracking data to indicate the memory pages that are dirty (i.e., written to by the VF), and can provide access to the dirty page tracking data. The hypervisor can thereby obtain and use the dirty page tracking data.

Abstract: Data centers often run long lived services such as web servers that are intended to run for hours, days, or even longer before being torn down and replaced with another instance of the long-lived service. Currently, many applications are being implemented with microservice architectures that run short lived services that start up, implement an operation, and are then torn down. An aspect of starting up a service is creating administrative data structures such as InfiniBand queue pairs. A packet processing pipeline having a DMA output stage can be configured to create the administrative data structures, thereby increasing the rate at which the administrative data structures are created. As a result, services running in data centers can be started up more rapidly and efficiently.

Abstract: InfiniBand transport protocol today supports RDMA operations such as read and write with each operation having an opcode defined in the InfiniBand standard. Currently, new RDMA operations require extending the transport protocol by defining a new opcode, its respective header and enhancing InfiniBand implementations to support this new behavior. A more robust way of extending RDMA without requiring an expanding set of opcodes is to register computer code by associating it with a code key similar to a memory key. An InfiniBand channel adapter receiving an RDMA request that includes a code key executes the associated computer code, perhaps compiling it first, in response to receiving the RDMA request. The RDMA response returned to the requester includes an execution result indicating an outcome of executing the executable computer code.

Abstract: A multitude of data transfer queues can have data transfer operations that are scheduled for a processing circuit to perform. Some of the data transfer queues may submit so many or such large data transfer operations that others receive little or no attention. The situation can be resolved in the data plane via a processing circuit that performs the data transfer operations in conjunction with priority evaluation operations that can assign the data transfer queues to different scheduler priority classes. A scheduler can schedule data transfer operations based on the scheduler priority classes of the data transfer queues.

Abstract: A multitude of data transfer queues can have data transfer operations that are scheduled for a processing circuit to perform. Some of the data transfer queues may submit so many or such large data transfer operations that others receive little or no attention. The situation can be resolved in the data plane via a processing circuit that performs the data transfer operations in conjunction with priority evaluation operations that can assign the data transfer queues to different scheduler priority classes. A scheduler can schedule data transfer operations based on the scheduler priority classes of the data transfer queues.

Abstract: The InfiniBand transport protocol supports the concept of a SRQ (shared receive queue) by which multiple QPs (queue pairs) can share the same receive queue resources. According to the InfiniBand Specification, when a SRQ is enabled, flow control needs to be disabled. The lack of flow control mechanism results in there being no fairness guarantees across multiple requesters. Fairness across requesters can be obtained by implementing a SRQ configured to receive request messages from requesters initiating transactions that consume WQEs (work queue elements) of the SRQ, monitoring consumption of the WQEs by the requesters, determining that a requester has a WQE consumption exceeding a policing threshold, and in response to determining that the WQE consumption of the requester exceeds the policing threshold, sending a response message to the requester that results in reducing the WQE consumption of the requester.

Abstract: Load balancing of NVMe targets based on real time metrics can be obtained for NAS appliances mirroring a namespace by assigning the NAS appliances to service sets that include an active load balancing set, a monitored inactive set, and an out of service set. Storage performance metrics of the NAS appliances can be tracked by monitoring IO operations for accessing a NAS mirroring the namespace in a non-volatile memory. Based on the storage metrics, NAS appliances can be moved from one of the service sets to another. Dummy IO operations can be used to track the storage performance metrics of monitored inactive NAS appliances such that a monitored inactive NAS may be moved to the active load balancing set when certain performance constraints are met.

Abstract: Virtual functions (VFs) running on SR-IOV (single root IO virtualization) capable PCIe devices can migrate in association with VMs using the VFs. A SR-IOV capable PCIe device installed in a host computer can implement the VFs. A VM running on the host and associated with the VF can use the VF to obtain a service such as network communications or access to a NAS device. Migrating the VF in association with the VM can include halting the VM in a VM state on the host, halting the VF in a PCIe state and then obtaining a PCIe state data, restarting the VF in the PCIe state on a second PCIe device of a second host based on the PCIe state data, and restarting the VM in the VM state on the second host, wherein the VM is configured to use the VF on the second PCIe device.

Abstract: Load balancing of NVMe targets based on real time metrics can be obtained for NAS appliances mirroring a namespace by assigning the NAS appliances to service sets that include an active load balancing set, a monitored inactive set, and an out of service set. Storage performance metrics of the NAS appliances can be tracked by monitoring IO operations for accessing a NAS mirroring the namespace in a non-volatile memory. Based on the storage metrics, NAS appliances can be moved from one of the service sets to another. Dummy IO operations can be used to track the storage performance metrics of monitored inactive NAS appliances such that a monitored inactive NAS may be moved to the active load balancing set when certain performance constraints are met.

Abstract: Increased fairness for small vs large NVMe IO commands for accessing a non-volatile memory namespace provided by a network attached storage appliance can be realized by placing NVMe submissions received by a NVMe SQ on a first fabric queue set or a second fabric queue set based on a fairness policy. The first fabric queue set accesses the namespace via a first fabric connection. The second fabric queue set accesses the namespace via a second fabric connection. Accessing the namespace via the fabric connections results in NVMe completions that are merged from the fabric queue sets onto an NVMe completion queue. A process producing the NVMe submissions and receiving the resulting NVMe completions may be unaware of the multiple fabric queue sets.

Abstract: A service gateway maintains forwarding components operative to forward data packets within corresponding VPNs, and also maintains subscriber sessions for subscribers via respective subscriber interfaces. The association between the subscribers and the forwarding components is independent of the subscriber interfaces, such that the subscribers reachable via a given interface are associable with any forwarding component. Upon detecting an appropriate event, such as a service selection action, the service gateway modifies the forwarding components of first and second VPNs to reflect that the subscriber session is active in the second VPN and is not active in the first VPN. The service gateway also effects a change of a network address that identifies the corresponding subscriber from a first network address defined in the first VPN to a second network address defined in the second VPN. Mechanisms for effecting such a change of network address include DHCP, IPCP, RADIUS, and NAT.

Abstract: An edge router termed a “service gateway” operates to reassign network addresses such as Internet Protocol (IP) addresses to a subscriber, such as when the subscriber is to be transitioned from a first virtual private network (VPN) to a second VPN. The service gateway obtains a new network address routable in a second VPN and applies dynamic edge network address translation (NAT) on an interim basis to provide instant access to the second VPN (following web-based identification for example), while a prior lease for an initial network address not routable in the second VPN is still in effect. When the subscriber attempts to renew the lease in due course, the renewal request is rejected, which forces the subscriber to re-initiate dynamic host control protocol (DHCP) procedures to obtain a new network address. At this point, the interim NAT mapping is removed and the new network address is assigned directly to the subscriber via DHCP.