Abstract: The present disclosure provides a proactive method of prefix disaggregation in a network fabric when one or more communication failures are detected. In one aspect, a method includes determining, by a first node of a network fabric, a corresponding prefix disaggregation policy for at least one second node of the network fabric, the corresponding prefix disaggregation policy identifying one or more network prefixes that are inaccessible via the first node when at least one communication failure is detected in association with the first node; sending the corresponding prefix disaggregation policy to the second node; and causing the second node to implement the prefix disaggregation policy upon detecting the at least one communication failure.

Abstract: Presented herein are methods and systems that facilitate data plane signaling of a packet as a candidate for capture at various network nodes within an IPv6 network. The signaling occurs in-band, via the data plane—that is, a capture or interrogation signal is embedded within the respective packet (e.g., in the packet header) that carries a user traffic. The signaling is inserted, preferably when the packet is classified, e.g., at the ingress node of the network, to which subsequent network nodes with the IPv6 network are signaled to capture or further inspect the packet for capture.

Abstract: Technologies for proving packet transit through uncompromised nodes are provided. An example method can include receiving a packet including one or more metadata elements generated based on security measurements from a plurality of nodes along a path of the packet; determining a validity of the one or more metadata elements based on a comparison of one or more values in the one or more metadata elements with one or more expected values calculated for the one or more metadata elements, one or more signatures in the one or more metadata elements, and/or timing information associated with the one or more metadata elements; and based on the one or more metadata elements, determining whether the packet traversed any compromised nodes along the path of the packet.

Abstract: Systems, methods, and computer-readable for load distribution amongst smart network interface cards (sNICs) connected to a host device include a controller. The controller can instantiate an agent in the host device to obtain telemetry information pertaining to the sNICs, where the sNICs can be used for communication between the host device and upstream devices in a software-defined network. The telemetry information indicates service offloading capabilities of the sNICs. The controller can also obtain network topology information pertaining to at least the host device, the sNICs and the upstream devices, and determine load distribution policies for the sNICs based on the network topology information and the telemetry information. The controller can provide the load distribution policies to the one or more upstream devices, where the load distribution policies take into account the service offload capabilities of the sNICs.

Abstract: Techniques for initiator-based data-plane validation of segment routed, multiprotocol label switched (MPLS) networks are described herein. In examples, an initiating node may determine to validate data-plane connectivity associated with a network path of the MPLS network. The initiating node may store validation data in a local memory of the initiating node. In examples, the initiating node may send a probe message that includes a request for identification data associated with a terminating node. The terminating node may send a probe reply message that includes the identification data, as well as, in some examples, a code that instructs the initiating node to perform validation. In examples, the initiating node may use the validation data stored in memory to compare to the identification data received from the terminating node to validate data-plane connectivity. In some examples, the initiating node may indicate a positive or negative response after performing the validation.

Abstract: Techniques for defining a service flow definition among container pods that provide services in a network. The techniques may include an orchestrator of a computer network platform of the network determining which container pods need to communicate with which container pods. The service flow definition thus indicates needed paths between the container pods. In configurations, a cluster topology may be determined where the cluster topology indicates corresponding nodes of the network in which each container pod is located, as well as end points of the network with which the corresponding nodes communicate. Based at least in part on the service flow definition and the cluster topology, corresponding route distribution policies may be determined for the end points. The corresponding route distribution policies may be applied to the end points.

Abstract: Techniques for identifying nodes in a data center fabric that are affected by a failure in the fabric, and selectively sending disaggregation advertisements to the nodes affected by the failure. The techniques include a process where a component monitors the network fabric to identify communication paths between leaf nodes, and determines what leaf nodes would be affected by a failure in those communication paths. The component may detect a failure in the network and determine which communication paths, and thus which leaf nodes, are affected by the failure and send disaggregation advertisements to the affected leaf nodes. In some examples, ingress leaf nodes send data through the fabric that indicate egress nodes for the communication paths. Intermediate nodes along may receive the data from the leaf nodes to identify communication paths, and the notify only affected nodes upon detecting a failure in the network.

Abstract: Techniques for utilizing edge nodes disposed throughout a multi-site cloud computing network to generate a probe packet including indicators that guarantee the use of forward and return route paths to accurately measure the network performance of a route path between two endpoints in a wide area network (WAN). An edge node disposed in a site of the multi-site cloud computing network may store in virtual memory associated with the edge node, a mapping between route paths, usable to send data from the edge node to remote edge nodes in remote sites, and route indicators. A probe packet may include a data portion for measuring the network performance of a route path, a portion including local and remote discriminators, and/or an inner and an outer header.

Abstract: This disclosure provides systems, devices, apparatus, and methods, including computer programs encoded on storage media, for fast incremental shared constants. In aspects, a CPU may determine/update shared constant data for a first draw call of a plurality of draw calls. The shared constant data, which may correspond to at least one shader, may be updated based on a draw call update for the first draw call. The CPU may communicate the updated shared constant data for the first draw call to a GPU. The GPU may receive, in at least one register, the updated shared constant data from the CPU and configure the at least one register based on the updated shared constant data corresponding to the draw call update of the first draw call of the plurality of draw calls.

Abstract: Methods, systems, and devices for graphics processer unit (GPU) operations are described. A device may monitor one or more states of a GPU during a duration. Based on monitoring the one or more GPU states, the device may determine an execution of a GPU command that is common to at least two GPU operations for clearing the GPU buffer. The device may determine whether the GPU clear command has previously been executed during a duration or a GPU cycle in which the device monitored the GPU states. The device may process the GPU clear command based on the determination of whether the GPU clear command has previously been executed. For example, the device may drop the GPU clear command based on the determination or modify a portion of the GPU clear command and execute at least the modified portion of the GPU clear command.

Abstract: This disclosure provides systems, devices, apparatus, and methods, including computer programs encoded on storage media, for configurable aprons for expanded binning. Aspects of the present disclosure include identifying one or more pixel tiles in at least one bin and determining edge information for each pixel tile of the one or more pixel tiles. The edge information may be associated with one or more pixels adjacent to each pixel tile. The present disclosure further describes determining whether at least one adjacent bin is visible based on the edge information for each pixel tile, where the at least one adjacent bin may be adjacent to the at least one bin.

Abstract: Methods, systems, and devices for graphics processer unit (GPU) operations are described. A device may monitor one or more states of a GPU during a duration. Based on monitoring the one or more GPU states, the device may determine an execution of a GPU command that is common to at least two GPU operations for clearing the GPU buffer. The device may determine whether the GPU clear command has previously been executed during a duration or a GPU cycle in which the device monitored the GPU states. The device may process the GPU clear command based on the determination of whether the GPU clear command has previously been executed. For example, the device may drop the GPU clear command based on the determination or modify a portion of the GPU clear command and execute at least the modified portion of the GPU clear command.

Abstract: Systems, methods, and computer-readable media are provided for signing and executing graphics processing unit (GPU) commands. In some examples, a method can include receiving, by a GPU, one or more commands including one or more verification signatures generated using a processor, each verification signature of the one or more verification signatures including a first value generated based on the one or more commands; generating, by the GPU, one or more additional verification signatures associated with the one or more commands, wherein each verification signature of the one or more additional verification signatures includes a second value generated by the GPU based on the one or more commands; and determining, by the GPU, a validity of the one or more commands based on a comparison of the one or more verification signatures and the one or more additional verification signatures.

Abstract: A method is performed by a node configured to implement an Operation, Administration, and Maintenance (OAM) protocol for rapid link failure detection. The node receives peer OAM packets sent by a peer node over a link at a peer periodic interval. While in a first mode of the OAM protocol, the node determines whether the peer node is reachable based on the peer OAM packets, sends OAM packets to the peer node at a periodic interval to indicate to the peer node that the node is reachable, and responsive to detecting a critical condition of the node that impairs the sending the OAM packets, transitions to a second mode of the OAM protocol. While in the second mode, the node adds, to the peer OAM packets, a code to indicate the critical condition, and reflects the peer OAM packets with the code back to the peer node.

Abstract: Methods and network devices are disclosed for traversal, within a network configured for bit indexed forwarding, of a subnetwork having nodes not configured for bit indexed forwarding. In one embodiment, a method includes receiving, from a next-hop upstream node configured for bit indexed forwarding, an incoming tree descriptor message comprising a tree identifier and a descriptor bit array. Bit values in the descriptor bit array identify intended destination nodes to be reached via a network tree identified by the tree identifier. The embodiment further includes replicating and modifying the incoming tree descriptor message to generate an outgoing tree descriptor message for a next-hop downstream node within the network tree. In addition, the embodiment includes sending the outgoing tree descriptor message to the next-hop downstream node and sending to the next-hop upstream node a local label allocated to the tree identifier.

Abstract: Techniques for initiator-based data-plane validation of segment routed, multiprotocol label switched (MPLS) networks are described herein. In examples, an initiating node may determine to validate data-plane connectivity associated with a network path of the MPLS network. The initiating node may store validation data in a local memory of the initiating node. In examples, the initiating node may send a probe message that includes a request for identification data associated with a terminating node. The terminating node may send a probe reply message that includes the identification data, as well as, in some examples, a code that instructs the initiating node to perform validation. In examples, the initiating node may use the validation data stored in memory to compare to the identification data received from the terminating node to validate data-plane connectivity. In some examples, the initiating node may indicate a positive or negative response after performing the validation.

Abstract: The present disclosure relates to methods and apparatus for hybrid rendering of video/graphics content by a graphics processing unit. The apparatus can configure the graphics processing unit of a display apparatus to perform multiple rendering passes for a frame of a scene to be displayed on a display device. Moreover, the apparatus can control the graphics processing unit to perform a first rendering pass of the multiple rendering passes to generate a first render target that is stored in either an on-chip graphics memory of the GPU or a system of the display apparatus. The apparatus can also control the graphics processing unit to perform a second rendering pass to generate a second render target that is alternatively stored in the system memory of the display apparatus or on-chip graphics memory of the GPU.

Abstract: Techniques and mechanisms for providing integrity verified paths using only integrity validated pods of nodes. A network service mesh (NSM) associated with a first pod may locally generate a nonce and provide the nonce to the first pod, where the request includes a request for an attestation token. Using the nonce, the first pod may generate the attestation token and reply back to the NSM. The NSM may generate a second request for an attestation token and forward it to a NSE pod, where the request includes a second locally generated nonce generated by the NSM. The NSE pod may generate the second attestation token using the second nonce and reply back to the NSM. The NSM may then have the attestation tokens verified or validated by a certificate authority (CA) server. The NSM may thus instantiate an integrity verified path between the first pod and the NSE pod.

Abstract: Techniques and mechanisms for providing continuous integrity validation-based control plane communication in a container-orchestration system, e.g., the Kubemetes platform. A worker node generates a nonce and forwards the nonce to a master node while requesting an attestation token. Using the nonce, the master node generates the attestation token and replies back to the worker node with the attestation token. The worker node validates the attestation token with a CA server to ensure that the master node is not compromised. The worker node sends its authentication credentials to the master node. The master node generates a nonce and forwards the nonce to the worker node while requesting an attestation token. Using the nonce, the worker node generates the attestation token and replies back to the master node with the attestation token. The master node validates the attestation token with the CA server to ensure that the worker node is not compromised.

Abstract: An ingress node inserts into a header of a packet service level agreement information and forwards the packet. At an egress node of the network, the packet is received and the service level agreement information is obtained from the header of the packet. The egress node verifies whether there is conformance to a service level agreement based on at least one parameter associated with reception of one or more packets at the egress node and the service level agreement information.