VM Packet Bypass with NIC Verification for Rate Limiting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine environments face inefficiencies in rate limiting, as hardware rate limiting requires extensive memory and increases costs, while software rate limiting results in high processor overhead and unpredictable packet transmission.
Innovation Solution
A system and method where virtual machines can bypass the hypervisor to directly enqueue packets on rate-limited hardware transmission queues, with the network interface controller verifying proper classification and authorization, allowing high-rate flows to bypass the hypervisor while ensuring adherence to rate limits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware rate limiting is implemented with multiple transmission queues, then rate limiting capability is improved, but memory requirements and system cost increase
Solution Approach 1:
The system segments rate limiting functionality across multiple components: hardware transmission queues in the NIC, software queues in the hypervisor, and classification tables in both. This segmentation allows the system to provide comprehensive rate limiting capability while distributing memory requirements across multiple locations rather than requiring all queues to exist simultaneously in one place.
Solution Approach 2:
The patent introduces a classification dimension based on packet flow characteristics (5-tuple: source IP, destination IP, source port, destination port, protocol). By classifying packets into different flows and maintaining separate rate limit counters for each flow, the system achieves fine-grained rate limiting without requiring separate hardware queues for every possible traffic type, thus reducing overall memory requirements.
2Adaptability or versatility
If software rate limiting is performed by the hypervisor, then rate limiting flexibility is improved, but processor overhead increases
Solution Approach 1:
The system performs preliminary classification of packets into flows using classification tables before rate limiting is applied. The VM NIC driver classifies packets using a transmission look-up table, and the NIC processor verifies classification using a flow look-up table. This preliminary action allows packets to be routed to appropriate hardware transmission queues without requiring continuous hypervisor intervention, reducing processor overhead while maintaining flexibility.
Solution Approach 2:
The patent introduces classification tables as an intermediary mechanism between the VM NIC driver and the rate limiting queues. These tables (transmission look-up table in VM driver, flow look-up table in NIC) act as mediators that pre-process and classify packets, enabling the hypervisor to focus on higher-level management tasks rather than individual packet classification, thus reducing its processor overhead.
3Speed
If packets are transmitted directly from VM to NIC bypassing hypervisor, then transmission speed is improved, but packet classification accuracy may deteriorate
Solution Approach 1:
The system implements a feedback verification mechanism where the NIC processor verifies packet classification by checking the flow look-up table after the VM NIC driver has classified and enqueued packets. If classification is incorrect, the NIC can redirect packets to the hypervisor for reclassification or apply default rate limiting. This feedback loop ensures classification accuracy is maintained even as packets bypass the hypervisor for faster processing.
Solution Approach 2:
The VM NIC driver performs preliminary packet classification using its transmission look-up table before packets are transmitted to the NIC. This preliminary classification action allows packets to be pre-sorted into appropriate queues, enabling direct transmission without hypervisor intervention. The NIC then verifies this preliminary classification, ensuring accuracy while maintaining the speed benefits of bypassing the hypervisor.
Data Source
AI summary
The present application describes a system and method for a virtual machine to classify a packet. Once the virtual machine (VM) classifies the packet, it bypasses a hypervisor to enqueue the packet directly on a hardware transmission queue. The NIC will then verify that the VM classified and enqueued the packet correctly. If the packet was classified properly, it is transmitted over the wire to its destination. In this regard, the system and method provides a technique for verifying that the VM is enqueuing packets properly, while improving performance by allowing high-rate flows to bypass the hypervisor.