Specific embodiments of the invention will now be described in detail with reference to the accompanying figures. Like elements in the various figures are denoted by like reference numerals for consistency.
In the following detailed description of embodiments of the invention, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to one of ordinary skill in the art that the invention may be practiced without these specific details. In other instances, well-known features have not been described in detail to avoid unnecessarily complicating the description.
In general, embodiments of the invention provide a method and system to bypass the data link layer. Specifically, embodiments of the invention provide a method and system to bypass the data link layer using a token and a function pointer.
In one embodiment of the invention, analyzing individual packets includes determining to which of the hardware receive rings (106A, 106D) each packet is sent. In one embodiment of the invention, analyzing the packets by the classifier (104) includes analyzing one or more fields in each of the packets to determine to which of the hardware receive rings (106A, 106D) the packets are sent. As an alternative, the classifier (104) may use the contents of one or more fields in each packet as an index into a data structure that includes information necessary to determine to which receive ring (106A, 106D) that packet is sent. The classifier (104) may be implemented entirely in hardware (i.e., the classifier (104) may be a separate microprocessor embedded on the NIC (102)). Alternatively, the classifier (104) may be implemented in software stored in memory (e.g., firmware, etc.) on the NIC and executed by a microprocessor on the NIC (102).
In one embodiment of the invention, the host (100) may include the following components: a device driver (107), one or more virtual NICs (108A, 108D), one or more virtual network stacks (114A, 114D) including one or more virtual serialization queues (112A, 112D), one or more packet destinations (e.g., containers and/or services) (not shown) and/or one or more virtual machines (not shown). In one embodiment of the invention, the device driver (107) provides an interface between the hardware receive rings (106A, 106D) and the host (100). More specifically, the device driver (107) exposes the hardware receive rings (106A, 106D) to the host (100). In one embodiment of the invention, the device driver (107) may maintain a metadata structure (e.g., schema, table, index, view, etc.) for each of the hardware receive rings (106A, 106D).
In one embodiment of the invention, each of the virtual NICs ( 08A, 108D) is associated with one or more hardware receive rings (106A, 106D). The virtual NICs (108A, 108D) provide an abstraction layer between the NIC (102) and the various packet destinations (or virtual machines) executing on the host (100). The virtual NICs (108A, 108D) may be considered the data link layer of the host (100). Each virtual NIC (108A, 108D) operates like a NIC (102). For example, in one embodiment of the invention, each virtual NIC (108A, 108D) is associated with one or more Internet Protocol (IP) addresses, and one or more Media Access Control (MAC) addresses. Further, each virtual NIC (108A, 108D) may be optionally associated with one or more ports, and/or configured to handle one or more protocol types. Thus, while the host (100) may be operatively connected to a single NIC (102), packet destinations (or virtual machines) executing on the host (100)) operate as if the host (100) is bound to multiple NICs.
Each virtual NIC (108A, 108D) is operatively connected to a corresponding virtual network stack (114A, 114D). Each virtual network stack (114A, 114D) includes network layer functionality. In one embodiment of the invention, network layer functionality corresponds to functionality to manage packet addressing and delivery on a network (e.g., functionality to support IP, Address Resolution Protocol (ARP), Internet Control Message Protocol, etc.). Further, each virtual network stack (114A, 114D) may also include functionality, as needed, to perform additional processing on the incoming and outgoing packets. This additional processing may include, but is not limited to, cryptographic processing, firewall routing, etc.
In one embodiment of the invention, each virtual network stack (114A, 114D) includes a virtual serialization queue (e.g., Virtual Serialization Queue A (112A), Virtual Serialization Queue D (112D), respectively). Further, each virtual serialization queue (112A, 112D) is configured to send and receive packets from an associated virtual NIC (108A, 108D). In addition, each virtual serialization queue (112A, 112D) is configured to send and receive packets from one or more associated packet destinations (or virtual machines) (not shown).
In one embodiment of the invention, the host (100) may include one or more CPUs (not shown). Further, each virtual serialization queue (112A, 112D) is bound to one of the CPUs. Those skilled in the art will appreciate that any number of virtual serialization queues may be bound to a CPU. The host (100) may also include one or more packet destinations (or virtual machines). In one embodiment of the invention, the packet destination(s) corresponds to any process or group of processes executing on the host that sends and receives network traffic, where the packet destination does not include a virtual network stack. Examples of packet destinations include, but are not limited to containers, services (e.g., web server), etc.
In one embodiment of the invention, the virtual NIC (108A, 108D) may be bound to a virtual machine (e.g., Xen Domain) instead of a virtual network stack (114A, 114D). In such cases, the virtual NIC is bound to an interface (e.g., a Xen interface), where the interface enables the virtual NIC to communicate to with the virtual machine. In one embodiment of the invention, the aforementioned virtual machine includes its own virtual network stack and includes its own operating system (OS) instance, which may be different than the OS executing on the host.
At this stage, the virtual serialization queue is bound to a packet destination (STEP 212). Those of ordinary skill in the art will appreciate that the packet destination may be bound to the virtual serialization queue any time after the virtual serialization queue has been created.
In STEP 215, a virtual NIC is created and bound to the virtual network stack. The classifier is subsequently programmed such that network traffic for the virtual serialization queue created in STEP 205 is directed to a particular hardware receive ring by the classifier (STEP 220). In STEP 230, a token identifying the virtual serialization queue is stored in the metadata structure (discussed above) associated with the hardware receive ring. Similarly, a token identifying the hardware receive ring is stored in the corresponding virtual serialization queue. In one embodiment of the invention, at least one of the tokens is a cookie.
In STEP 240, a determination is made whether incoming packets destined for the virtual serialization queue may be delivered directly to the virtual network stack without using the virtual NIC. In other words, it is determined whether incoming packets destined for the virtual serialization queue may bypass the virtual NIC. In one embodiment of the invention, incoming packets destined for the virtual serialization queue may bypass the virtual NIC providing the packets are destined solely for the virtual serialization queue (e.g., no other component on the host is monitoring the incoming packets, the packets themselves are not intended for other destinations besides the virtual serialization queue, etc.).
If it is determined in STEP 240 that the packets destined for the virtual serialization queue may bypass the virtual NIC, then a function pointer may be placed in the metadata structure associated with the hardware receive ring (STEP 245). The function pointer may be used to call a function in the virtual network stack to process an incoming packet (discussed below).
If it is determined in STEP 240 that the packets destined for the virtual serialization queue must use the virtual NIC (e.g., other components on the host are monitoring the incoming packets, the packets are destined for other destinations besides the virtual serialization queue, etc.), then a function pointer may be placed in the metadata structure associated with the hardware receive ring (STEP 250). The function pointer in STEP 250, however, is used to call a function in the virtual NIC to process an incoming packet (discussed below).
In one embodiment of the invention, the host may change the function pointer in the metadata structure associated with the hardware receive ring at any time. In one embodiment of the invention, the change may occur by replacing the existing function pointer with a different function pointer. For example, if the virtual NIC is currently being bypassed (i.e., the VNIC is in bypass mode) and one or more components on the host are to begin monitoring the packets, the VNIC may replace the existing function pointer with a new function pointer. The new function pointer may call a function in the virtual NIC to enable monitoring of the packets (i.e., disable bypass mode). Similarly, if the packets destined for the virtual serialization queue are presently being monitored and there is no longer a requirement to monitor the packets, the existing function pointer may be replaced with a new function pointer that directly calls a function in the virtual network stack, enabling bypass mode.
If the called function belongs to the virtual NIC (STEP 320) (discussed above), then the token stored in the metadata structure and the packet are sent to the virtual NIC function for processing (STEP 325). In one embodiment of the invention, processing the packet by the virtual NIC function includes calculating a statistic based on the packet (e.g, the number packets received per unit time). In one embodiment of the invention, the virtual NIC function sends the packet to a function in the virtual network stack based on the token for both further processing and to deliver the packet to the virtual serialization queue (STEP 330). In other words, the virtual NIC function has minimal processing because the token already provides the target destination in the virtual network stack for the packet.
If the called function belongs to the virtual network stack (STEP 320) (i.e., the VNIC is in bypass mode), then the packet is sent directly to the virtual network stack function for processing and subsequent delivery of the processed packet to the virtual serialization queue. In other words, the packet bypasses the virtual NIC. In one embodiment of the invention, the virtual stack function calculates a statistic based on the packet (e.g, the number of packets received per unit time). In one embodiment of the invention, the statistic may be accessed (e.g., via an application programming interface (API)) by other components on the host.
As discussed above, in one embodiment of the invention, the called function (e.g.,
The invention may be implemented on virtually any type of computer regardless of the platform being used. For example, as shown in
While the invention has been described with respect to a limited number of embodiments, those skilled in the art, having benefit of this disclosure, will appreciate that other embodiments can be devised which do not depart from the scope of the invention as disclosed herein. Accordingly, the scope of the invention should be limited only by the attached claims.
The present application contains subject matter that may be related to the subject matter in the following U.S. applications filed on Apr. 22, 2005, and assigned to the assignee of the present application: “Method and Apparatus for Managing and Accounting for Bandwidth Utilization Within A Computing System” with U.S. application Ser. No. 11/112,367 (Attorney Docket No. 03226/643001; SUN050681); “Method and Apparatus for Consolidating Available Computing Resources on Different Computing Devices” with U.S. application Ser. No. 11/112,368 (Attorney Docket No. 03226/644001; SUN050682); “Assigning Higher Priority to Transactions Based on Subscription Level” with U.S. application Ser. No. 11/112,947 (Attorney Docket No. 03226/645001; SUN050589); “Method and Apparatus for Dynamically Isolating Affected Services Under Denial of Service Attack” with U.S. application Ser. No. 11/112,158 (Attorney Docket No. 03226/646001; SUN050587); “Method and Apparatus for Improving User Experience for Legitimate Traffic of a Service Impacted by Denial of Service Attack” with U.S. application Ser. No. 11/112,629 (Attorney Docket No. 03226/647001; SUN050590); “Method and Apparatus for Limiting Denial of Service Attack by Limiting Traffic for Hosts” with U.S. application Ser. No. 11/112,328 (Attorney Docket No. 03226/648001; SUN050591); “Hardware-Based Network Interface Per-Ring Resource Accounting” with U.S. application Ser. No. 11/112,222 (Attorney Docket No. 03226/649001; SUN050593); “Dynamic Hardware Classification Engine Updating for a Network Interface” with U.S. application Ser. No. 11/112,934 (Attorney Docket No. 03226/650001; SUN050592); “Network Interface Card Resource Mapping to Virtual Network Interface Cards” with U.S. application Ser. No. 11/112,063 (Attorney Docket No. 03226/651001; application Ser. No. 11/112,063 (Attorney Docket No. 03226/651001; SUN050588); “Network Interface Decryption and Classification Technique” with U.S. application Ser. No. 11/112,436 (Attorney Docket No. 03226/652001; SUN050596); “Method and Apparatus for Enforcing Resource Utilization of a Container” with U.S. application Ser. No. 11/112,910 (Attorney Docket No. 03226/653001; SUN050595); “Method and Apparatus for Enforcing Packet Destination Specific Priority Using Threads” with U.S. application Ser. No. 11/112,584 (Attorney Docket No. 03226/654001; SUN050597); “Method and Apparatus for Processing Network Traffic Associated with Specific Protocols” with U.S. application Ser. No. 11/112,228 (Attorney Docket No. 03226/655001; SUN050598). The present application contains subject matter that may be related to the subject matter in the following U.S. applications filed on Oct. 21, 2005, and assigned to the assignee of the present application: “Method and Apparatus for Defending Against Denial of Service Attacks” with U.S. application Ser. No. 11/255,366 (Attorney Docket No. 03226/688001; SUN050966); “Router Based Defense Against Denial of Service Attacks Using Dynamic Feedback from Attacked Host” with U.S. application Ser. No. 11/256,254 (Attorney Docket No. 03226/689001; SUN050969); and “Method and Apparatus for Monitoring Packets at High Data Rates” with U.S. application Ser. No. 11/226,790 (Attorney Docket No. 03226/690001; SUN050972). The present application contains subject matter that may be related to the subject matter in the following U.S. applications filed on Jun. 30, 2006, and assigned to the assignee of the present application: “Network Interface Card Virtualization Based On Hardware Resources and Software Rings” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/870001; SUN061020); “Method and System for Controlling Virtual Machine Bandwidth” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/871001; SUN061021); “Virtual Switch” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/873001; SUN061023); “System and Method for Virtual Network Interface Cards Based on Internet Protocol Addresses” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/874001; SUN061024); “Virtual Network Interface Card Loopback Fastpath” with U.S. Application Ser. No. TBD (Attorney Docket No. 03226/876001; SUN061027); “Bridging Network Components” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/877001; SUN061028); “Reflecting the Bandwidth Assigned to a Virtual Network Interface Card Through Its Link Speed” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/878001; SUN061029); “Method and Apparatus for Containing a Denial of Service Attack Using Hardware Resources on a Virtual Network Interface Card” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/879001; SUN061033); “Virtual Network Interface Cards with VLAN Functionality” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/882001; SUN061037); “Method and Apparatus for Dynamic Assignment of Network Interface Card Resources” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/883001; SUN061038); “Generalized Serialization Queue Framework for Protocol Processing” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/884001; SUN061039); “Serialization Queue Framework for Transmitting Packets” with U.S. application Ser. No. TBD (Attorney Docket No. 03226/885001; SUN061040).