NIC Virtualization via Hardware Segmentation and Destination Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virtualization approaches for network interface circuitry (NIC) in host computers with multiple operating systems or functions face substantial computational load and overhead, particularly with high-speed network interfaces, and lack effective segregation of memory references and data structures, leading to potential data corruption across guest OS instances.
Innovation Solution
The NIC is configured to operate without promiscuous mode, segregating memory references and using destination address filtering to direct network packets to specific guest OS instances, offloading protocol processing, and employing direct data placement to minimize overhead and ensure memory safety, allowing each guest OS to use separate data structures and queues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the NIC operates in promiscuous mode to accept all layer-2 network packets, then all guest OS instances can receive network traffic, but the computational load on the virtualization layer increases substantially and unnecessary packet processing occurs
Solution Approach 1:
The patent segments the network packet filtering function from the virtualization layer and relocates it to the NIC hardware. The NIC is configured with multiple filter sets, each associated with a specific guest OS instance, enabling hardware-based packet filtering that directs packets to the appropriate guest without requiring software-based demultiplexing. This segmentation resolves the contradiction by maintaining versatile packet reception capability while eliminating the computational burden on the virtualization layer through hardware offloading of the filtering and routing decisions.
2Adaptability or versatility
If the NIC operates in promiscuous mode to enable virtualization features, then multiple guest OS instances can share the NIC, but memory references and data structures are not segregated, leading to potential data corruption
Solution Approach 1:
The patent segments memory references and data structures by associating each guest OS instance with specific filter sets and memory regions. The NIC hardware maintains separate filter sets for each guest, ensuring that packets destined for one guest are directed only to that guest's memory space. This hardware-enforced segmentation prevents unauthorized memory access and data corruption between guests while maintaining full multi-guest OS support.
Solution Approach 2:
The patent introduces filter sets as an intermediary layer between the NIC and guest OS instances. These filter sets act as hardware-based mediators that inspect packets, determine the appropriate destination guest, and direct traffic accordingly. This intermediary mechanism ensures reliable packet routing while maintaining strict memory segregation, preventing direct access between guest memory spaces and eliminating the risk of data corruption.
3Reliability
If separate NICs are used for different applications (Ethernet for general network, Fibre Channel for storage, high speed interconnect for HPC), then specialized performance is achieved, but cost and management complexity increase
Solution Approach 1:
The patent enables a single NIC to perform multiple specialized functions by configuring it with different filter sets for different application types. The same physical NIC can handle Ethernet traffic for general networking, Fibre Channel protocols for storage, and high-speed interconnect protocols for HPC, all simultaneously. This multi-functionality is achieved through hardware-based protocol recognition and filtering, allowing one NIC to replace what would traditionally require multiple specialized NICs, thereby reducing device complexity and management overhead while maintaining application-specific performance.
Data Source
AI summary
The present invention is in the field of virtualization of Network Interface Cards and Controllers (NIC) that connect to for example a host computer that can have multiple functions and OS's (referred to as guest functions and guest-OS's) running on it simultaneously and, in particular, relates to the virtualization of the operation of a single NIC such that it can be used simultaneously by multiple guests in such a manner that memory references due to the network traffic originating from and destined to a particular guest is kept separate from other network traffic, and that allows the Media Access Controller (MAC) within the NIC to operate such that it only accepts network packets that are destined to one of the guest-functions or guest-OS's, and the MAC is not required to operate in promiscuous mode where it accepts all incoming packets in order to implement the virtualization features.