SR-IOV Network Interface Card Virtual Bridge Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing systems, network interface cards with SR-IOV passthrough capabilities lack the ability to provide abundant network functions such as security groups, quality of service, layer 2 tunnel encapsulation, and distributed routing due to limited processing and storage capabilities of the switching equipment.
Innovation Solution
A packet processing method that involves a virtual machine monitor with a virtual bridge and a virtual network function module, where data packets from virtual machines are forwarded to the virtual bridge, and then processed by the virtual network function module to provide enhanced network functions, including using an ARP process to determine the destination MAC address for layer 2 forwarding and routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network interface card virtualization (SR-IOV passthrough) is used to allow virtual machines to share the network interface card, then network performance and resource utilization are improved, but the ability to provide abundant network functions (security group, QoS, layer 2 tunnel encapsulation, distributed routing) deteriorates due to limited processing and storage capabilities of the switching equipment
Solution Approach 1:
The patent introduces a virtual switch as an intermediary component between the physical network interface card and the virtual machines. This virtual switch, implemented in software on the host system, mediates network traffic and enables complex network functions (security groups, QoS, layer 2 tunnel encapsulation, distributed routing) that the hardware switching equipment cannot provide. The virtual switch acts as a mediator that bridges the gap between the simple hardware forwarding capability and the need for advanced network functions, allowing virtual machines to access both high-performance direct network access and sophisticated network services.
2Speed
If switching equipment in the network interface card is used to forward data packets, then packet forwarding speed is improved, but the provision of abundant network functions deteriorates due to limited processing and storage capabilities
Solution Approach 1:
The patent replaces the hardware-based switching equipment's packet forwarding function with a software-based virtual switch implementation. The virtual switch runs on the host system's general-purpose processor, substituting the dedicated hardware switching mechanism. This substitution allows the system to leverage the host's processing power and memory resources to implement complex network functions (security groups, QoS, layer 2 tunnel encapsulation, distributed routing) that cannot be implemented in the constrained hardware environment of the network interface card's switching equipment, while still maintaining packet forwarding capability through software.
3Productivity
If the network interface card is virtualized into physical functions and virtual functions for multiple virtual machines, then resource utilization is improved, but the provision of abundant network functions deteriorates due to limited processing capabilities of the switching equipment
Solution Approach 1:
The patent merges the virtual switching function with the virtual machine monitor (VMM) or host operating system, combining multiple functions into a unified software-based virtual switch. This virtual switch consolidates packet forwarding, security group enforcement, QoS management, layer 2 tunnel encapsulation, and distributed routing capabilities into a single software component that runs on the host system. By merging these functions in software rather than relying on the network interface card's hardware switching equipment, the system achieves both efficient resource utilization through virtualization and comprehensive network function support through the host system's processing capabilities.
Data Source
AI summary
A packet processing method in a computing system is disclosed. The computing system comprises a host, wherein at least one network interface card is connected to the host. The network interface card includes switching equipment and at least two network ports. A first network port is corresponding to at least one physical function PF and multiple virtual functions VFs. At least one VF of the first network port is provided for a first virtual machine on the host in a passthrough manner. The first virtual machine sends a data packet from the VF that is connected to the first virtual machine. Switching equipment of the first network port forwards the data packet according to a destination MAC address of the data packet, and sends the data packet to a virtual bridge on VMM of the host. The VMM provides abundant network function processing for the data packet.