Hardware Queue Manager Load Balancing for Anti-Replay Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-core computing systems face challenges in handling high throughput flows, particularly when a single high bandwidth flow exceeds the processing capacity of a core, leading to performance limitations and scalability issues in sequence number generation and anti-replay checks, especially in protocols like IPSec, due to the need for atomic processing and synchronization.
Innovation Solution
Implementing a hardware queue manager (HQM) as a dynamic load balancer (DLB) to distribute workload across multiple cores, ensuring atomicity in sequence number generation and anti-replay checks, and using ordered scheduling to maintain flow order while reducing spinlock penalties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a pipeline model is used to handle high bandwidth flows, then throughput scalability is improved, but inter stage communication and synchronization overhead increases
Solution Approach 1:
The packet processing pipeline is divided into multiple independent stages (L3 forwarding, L2 forwarding, MAC forwarding, security processing) that can execute in parallel. Each stage processes specific functions and communicates through shared memory structures, enabling throughput scalability while managing complexity through functional decomposition.
Solution Approach 2:
Shared memory structures serve as intermediaries between pipeline stages, enabling efficient data exchange without complex synchronization. The load balancing system acts as an intermediary that distributes packets across cores while maintaining flow order, reducing direct synchronization overhead between stages.
2Reliability
If atomic processing is used for sequence number generation and anti-replay checks, then data reliability is improved, but processing throughput decreases
Solution Approach 1:
Each CPU core maintains its own sequence number counter and anti-replay window, eliminating the need for atomic operations across cores. This local state approach ensures uniqueness and reliability while allowing parallel processing, as each core independently manages its sequence numbers without interfering with others.
Solution Approach 2:
The load balancing system creates copies of sequence number and anti-replay window state for each core, allowing independent processing. Each core receives a copy of the necessary state information and processes packets locally, then results are aggregated, eliminating atomic operation requirements while maintaining data consistency.
3Speed
If load balancing is implemented without locks, then processing speed is improved, but maintaining flow order becomes difficult
Solution Approach 1:
The load balancing system performs preliminary classification and routing decisions before packet processing begins. Packets are pre-sorted and assigned to specific cores based on flow characteristics, ensuring that packets within the same flow are processed in the correct order by the same core, eliminating the need for locks while maintaining flow order.
Solution Approach 2:
The system dynamically adjusts load balancing decisions based on real-time packet characteristics and core availability. The load balancer can redirect packets to different cores based on current system state, maintaining flow order through intelligent routing rather than static assignments or locking mechanisms.
Data Source
AI summary
Methods and apparatus to assign and check anti-replay sequence numbers. In one embodiment, a method includes assigning, by circuitry, sequence numbers to packets of traffic flows, wherein a first sequence number is assigned to a first packet based on a determination that the first packet is within a first traffic flow mapped to a first secure channel, and wherein the first sequence number is within a set of sequence numbers allocated to the first secure channel and maintained by the circuitry. The method continues with allocating the packets of traffic flows to be processed among a plurality of processor cores and processing the packets of traffic flows by the plurality of processor cores.