Patent Application
20150033222
This invention relates generally to communications in computer networks. More particularly, this invention is directed toward a network interface card with a virtual switch and traffic flow policy enforcement.
A Network Interface Card (NIC) 108 is coupled to the host computer 100 via a physical port 110 (typically a system bus, such as Peripheral Component Interface Express (PCIe)). The NIC 108 has a physical port 112 to interface to a network. Network traffic is processed by a processor 114, which accesses instructions in memory 116. In particular, the processor 114 implements various packet formatting, check and transferring operations.
The prior art system of
In view of the foregoing, it would be desirable to provide an improved host computer and network interface card.
A system includes a host computer executing virtual machines under the control of a hypervisor. A network interface card is coupled to the host machine. The network interface card implements a virtual switch with virtual ports. Each (one or more) virtual port is associated with a virtual machine. The network interface card may operate as a co-processor for the host managing selected traffic flow policies, such as QoS and bandwidth provisioning on a per virtual machine basis.
The invention is more fully appreciated in connection with the following detailed description taken in conjunction with the accompanying drawings, in which:
Like reference numerals refer to corresponding parts throughout the several views of the drawings.
A network interface card 206 is coupled to the host machine 200. The network interface card 206 implements a virtual switch 208. The virtual switch 208 receives network traffic from a physical port 210 and directs it to a designated virtual machine, which is accessed through a corresponding virtual port 212. That is, each virtual port or virtual network card 212 has a corresponding virtual machine. The virtual switch 208 directs traffic to a virtual port (e.g., 212_2), which results in the corresponding virtual machine (e.g., 202_2) receiving the traffic.
The virtual ports are implemented across a physical interface between the host 200 and the network interface card 206. The physical interface may be one or more Peripheral Component Interface Express (PCIe) ports. The virtual switch 208 maps a virtual port or virtual network card 212 to a physical port or physical network.
An advantage of this architecture is that it leverages processing power associated with the network interface card 206, thereby alleviating the host 200 of various processing tasks. Another advantage of this architecture is that the one-to-one correspondence between a virtual machine and its virtual network port results in a pre-set distribution of computing resources. Consequently, if a virtual machine comes under attack, there is no spill-over processing impact on other virtual machines.
Prior to routing, the network interface card may apply one or more traffic flow policies 404, as discussed below. The virtual machine identifier is used as an index into a flow table array that has one or more policy entries to specify what to do with the packet. In one embodiment, the Linux® kernel is used for fast path processing. If an entry is not found in the flow table, then an exception is thrown and the Linux® user space is used for slow path processing.
Afterwards, the virtual machine identifier is removed 406 and the packet is forwarded to the appropriate virtual port or virtual network card for delivery to the virtual machine corresponding to that virtual port or virtual network card 408.
The policy module 306 includes executable instructions to enforce various traffic management policies. For example, as shown in
The policy module 306 may also check for a Quality of Service (QoS) policy 604. The QoS policy may provide different priority to different users, flows, applications or devices. The QoS policy may guarantee a certain level of performance to a data flow. For example, a required bit rate, delay, jitter, packet dropping probability and/or bit error rate may be guaranteed. If such a policy exists (604—Yes), then the policy is applied 606. The QoS dynamic execution engine in the commonly owned U.S. Patent Publication 2013/0097350 is incorporated herein by reference and may be used to implement QoS operations. The packet priority processor in commonly owned U.S. Patent Publication 2013/0100812 is incorporated herein by reference and may also be used to implement packet processing operations. The packet traffic control processor in commonly owned U.S. Patent Publication 2013/0107711 is incorporated herein by reference and may also be used to implement packet processing operations.
The policy module 306 may also check for a TCP offload policy 608. If such a policy exists (608—Yes), then the offload policy is applied 610. The TCP offload policy may be applied with a TCP Offload engine (TOE). A TOE offloads processing of the entire TCP/IP stack to a network controller associated with the network interface card 206. The TCP offload is on a per virtual machine basis. Today, TCP offload is not virtualized. Instead a TOE on a network interface card assumes that one TCP stack is running because there is only one operating system running. In contrast, with the disclosed technology the network interface card has a number of virtual networks or virtual ports 212, which means that there is an equivalent number of TCP stacks running.
The policy module 306 may also check for a Secure Socket Layer (SSL) offload policy 612. If such a policy exists (612—Yes), then the offload policy is applied 614. For example, the network interface card 206 may include hardware and/or software resources to encrypt and decrypt the SSL traffic. In this case, the network interface card 206 terminates the SSL connections and passes the processed traffic to the host 200. Thus, the host is freed from SSL processing.
Any number of host tasks may be offloaded to the network interface card 206. For example, Internet Protocol Security (Ipsec) processing may also be implemented on the network interface card 206. Similarly, a tunneling protocol where one network protocol is encapsulated inside another network protocol may be implemented on the network interface card 206. Network Virtualization using Generic Routing Encapsulation (NVGRE) and other protocols may also be implemented on the network interface card 206.
An embodiment of the present invention relates to a computer storage product with a non-transitory computer readable storage medium having computer code thereon for performing various computer-implemented operations. The media and computer code may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well known and available to those having skill in the computer software arts. Examples of computer-readable media include, but are not limited to: magnetic media, optical media, magneto-optical media and hardware devices that are specially configured to store and execute program code, such as application-specific integrated circuits (“ASICs”), programmable logic devices (“PLDs”) and ROM and RAM devices. Examples of computer code include machine code, such as produced by a compiler, and files containing higher-level code that are executed by a computer using an interpreter. For example, an embodiment of the invention may be implemented using JAVA®, C++, or other object-oriented programming language and development tools. Another embodiment of the invention may be implemented in hardwired circuitry in place of, or in combination with, machine-executable software instructions.
The foregoing description, for purposes of explanation, used specific nomenclature to provide a thorough understanding of the invention. However, it will be apparent to one skilled in the art that specific details are not required in order to practice the invention. Thus, the foregoing descriptions of specific embodiments of the invention are presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise forms disclosed; obviously, many modifications and variations are possible in view of the above teachings. The embodiments were chosen and described in order to best explain the principles of the invention and its practical applications, they thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications as are suited to the particular use contemplated. It is intended that the following claims and their equivalents define the scope of the invention.
