Abstract: Examples described herein relate to a device including circuitry to permit or deny the device to write-to or read-from kernel space memory of a virtualized execution environment by use of multiple process identifiers. In some examples, the device is communicatively coupled with the virtualized execution environment in a manner consistent with one or more of: Single Root IO Virtualization (SR-IOV), Scalable I/O Virtualization (SIOV), or PCI express (PCIe). In some examples, to control write or read operations to kernel space memory of a virtualized execution environment by the device by use of multiple process identifiers, the circuitry is to perform an address translation based on a first process identifier and second process identifier associated with the virtualized execution environment.

Abstract: A performance monitor provides cache miss stall and memory bandwidth usage metric samples to a resource exhaustion detector. The detector can detect the presence of last-level cache and memory bandwidth exhaustion conditions based on the metric samples. If cache miss stalls and memory bandwidth usage are both trending up, the detector reports a memory bandwidth exhaustion condition to a resource controller. If cache miss stalls are trending up and memory bandwidth usage is trending down, the detector reports a last-level cache exhaustion condition to the resource controller. The resource controller can allocate additional last-level cache or memory bandwidth to the processor unit to remediate the resource exhaustion condition. If bandwidth-related metric samples indicate that a processor unit may be overloaded due to receiving high bandwidth traffic, the resource controller can take a traffic rebalancing remedial action.

Abstract: Examples described herein relate to a device that includes a host interface; circuitry coupled to the host interface; and second circuitry. The second circuitry is to limit usage of the circuitry, by a first process, by limiting performance of requests for translation of virtual memory addresses to physical memory addresses, from the first process. The circuitry includes one or more of: a network interface device, an accelerator, memory, or storage.

Abstract: A system comprising an interface to access a network slice power consumption parameter for a network slice comprising a logical network between two endpoints through a plurality of physical computing platforms; and a controller comprising circuitry, the controller to specify operating parameters for a plurality of hardware resources of a first physical computing platform in accordance with the network slice power consumption parameter.

Abstract: Apparatuses, methods, and computer readable media for regulating command submission to a shared device. A processor may receive a command for an operation to be performed by another device. The processor may determine an identifier of an address space of a process associated with the command. The processor may determine whether to accept or reject the command.

Abstract: Methods and apparatus relating to an efficient implementation of ZUC authentication are described. In one embodiment, a processor computes a tag update, based at least in part on stored data, for an authentication operation. The tag update is computed by replacing a ‘for’ loop with a carry-less multiply operation. Other embodiments are also claimed and disclosed.

Abstract: A computing device includes an appliance status table to store at least one of reliability and performance data for one or more network functions virtualization (NFV) appliances and one or more legacy network appliances. The computing device includes a load controller to configure an Internet Protocol (IP) filter rule to select a packet for which processing of the packet is to be migrated from a selected one of the one or more legacy network appliances to a selected one of the one or more NFV appliances, and to update the appliance status table with received at least one of reliability and performance data for the one or more legacy network appliances and the one or more NFV appliances. The computing device includes a packet distributor to receive the packet, to select one of the one or more NFV appliances based at least in part on the appliance status table, and to send the packet to the selected NFV appliance. Other embodiments are described herein.

Abstract: An apparatus includes an interface to memory, and a processor to execute one or more instructions. The instructions cause the processor to receive, via an application programming interface (API), a plurality of packets, respective packets of the plurality of packets comprising a respective header and a respective payload. Further, the instructions cause the processor to determine, by a QUIC protocol stack, to encrypt the plurality of packets in parallel. Further, the instructions cause the processor to encrypt the payloads of the plurality of packets in parallel. Further, the instructions cause the processor to encrypt the headers of the plurality of packets in parallel.

Abstract: Examples described herein relate to a non-transitory computer-readable medium comprising instructions, that if executed by circuitry, cause the circuitry to: configure circuitry to perform cryptographic operations on packets based on Advanced Encryption Standard with Galois/Counter Mode (AES-GCM) hash (GHASH), wherein the cryptographic operations comprise a reduction operation and wherein the reduction operation comprises a single Galois territory multiplication 64 bit operation. The circuitry can include one or more of: a central processing unit (CPU), CPU-executed microcode, an accelerator, or a network interface device.

Abstract: A computing device includes an appliance status table to store at least one of reliability and performance data for one or more network functions virtualization (NFV) appliances and one or more legacy network appliances. The computing device includes a load controller to configure an Internet Protocol (IP) filter rule to select a packet for which processing of the packet is to be migrated from a selected one of the one or more legacy network appliances to a selected one of the one or more NFV appliances, and to update the appliance status table with received at least one of reliability and performance data for the one or more legacy network appliances and the one or more NFV appliances. The computing device includes a packet distributor to receive the packet, to select one of the one or more NFV appliances based at least in part on the appliance status table, and to send the packet to the selected NFV appliance. Other embodiments are described herein.

Abstract: Technologies for dynamically selecting resources for virtual switching include a computing device configured to identify a present demand on processing resources of the computing device that are configured to process data associated with network packets received by the computing device. Additionally, the computing device is configured to determine a present capacity of one or more acceleration resources of the computing device and configure the virtual switch based on the present demand and the present capacity of the acceleration resources. Other embodiments are described herein.

Abstract: Methods and apparatus for optimization techniques for modular multiplication algorithms. The optimization techniques may be applied to variants of modular multiplication algorithms, including variants of Montgomery multiplication algorithms and Barrett multiplication algorithms. The optimization techniques reduce the number of serial steps in Montgomery reduction and Barrett reduction. Modular multiplication operations involving products of integer inputs A and B may be performed in parallel to obtain a value C that is reduced to a residual RES. Modular multiplication and modular reduction operations may be performed in parallel. The number of serial steps in the modular reductions are reduced to L, where L serial steps, where w is a digit size in bits, and L is a number of digits of operands=[k/w].

Abstract: Packets are differentiated based on their traffic class. A traffic class is allocated bandwidth for transmission. One or more core or thread can be allocated to process packets of a traffic class for transmission based on allocated bandwidth for that traffic class. If multiple traffic classes are allocated bandwidth, and a traffic class underutilizes allocated bandwidth or a traffic class is allocated insufficient bandwidth, then allocated bandwidth can be adjusted for a future transmission time slot. For example, a higher priority traffic class with excess bandwidth can share the excess bandwidth with a next highest priority traffic class for use to allocate packets for transmission for the same time slot.

Abstract: Examples include techniques to mitigate or prevent cache-based side-channel attacks to a cache. Examples include use of assigned class of service (COS) assigned to cores of a process to determine whether to notify an OS of a potential malicious application attempting to access a cache line cached to a processor cache. Examples also include marking pages in an application memory address space of a processor cache as unflushable to prevent a potentially malicious application from accessing sensitive data loaded to the application memory address space of the processor cache.

Abstract: Technologies for coordinating access to packets include a network device. The network device is to establish a ring in a memory of the network device. The ring includes a plurality of slots. The network device is also to allocate cores to each of an input stage, an output stage, and a worker stage. The worker stage is to process data in a data packet with an associated worker function. The network device is also to add, with the input stage, an entry to a slot in the ring representative of a data packet received with a network interface controller of the network device, access, with the worker stage, the entry in the ring to process at least a portion of the data packet, and provide, with the output stage, the processed data packet to the network interface controller for transmission.

Abstract: Technologies for power-aware scheduling include a computing device that receives network packets. The computing device classifies the network packets by priority level and then assigns each network packet to a performance group bin. The packets are assigned based on priority level and other performance criteria. The computing device schedules the network packets assigned to each performance group for processing by a processing engine such as a processor core. Network packets assigned to performance groups having a high priority level are scheduled for processing by processing engines with a high performance level. The computing device may select performance levels for processing engines based on processing workload of the network packets. The computing device may control the performance level of the processing engines, for example by controlling the frequency of processor cores. The processing workload may include packet encryption. Other embodiments are described and claimed.

Abstract: Examples herein relate to assigning, by a system agent of a central processing unit (CPU), an operating frequency to a core group based priority level of the core group while avoiding throttling of the system agent. Avoiding throttling of the system agent can include maintaining a minimum performance level of the system agent. A minimum performance level of the system agent can be based on a minimum operating frequency. Assigning, by a system agent of a central processing unit, an operating frequency to a core group based priority level of the core group while avoiding throttling of the system agent can avoid a thermal limit of the CPU. Avoiding thermal limit of the CPU can include adjusting the operating frequency to the core group to avoid performance indicators of the CPU. A performance indicator can indicate CPU utilization corresponds to Thermal Design Point (TDP).

Abstract: A processor-to-processor agent to provide connectivity over a processor-to-processor interconnect between services/network functions on different processors on a same compute node in a server is provided. The processor-to-processor agent can intercept socket interface calls using a network traffic filter in the network stack and redirect the packets based on traffic matching rules.

Abstract: Techniques and apparatuses for processing data unit are described. In one embodiment, for example, an apparatus for networking may include at least one memory, logic, at least a portion of the logic comprised in hardware coupled to the at least one memory, the logic to access an encrypted packet having an encrypted portion, determine at least one flow control segment of the encrypted portion, decrypt the at least one flow control segment to generate a partially-decrypted packet comprising a decrypted at least one flow control segment and an encrypted remainder portion, the remainder portion comprising a portion of the encrypted packet that does not include the decrypted at least one flow control segment, access process information in the decrypted at least one flow control segment, and process the partially-decrypted packet according to the process information. Other embodiments are described and claimed.

Abstract: Examples described herein relate to executing, on at least one processor, at least one Advanced Encryption Standard (AES) instruction, having an operation code (opcode), on operands, wherein execution of the at least one AES instruction generates an S1 box and/or S2 box of initialization and keystream generation for a SNOW3 cipher operation.