Fortinet, Inc.

Guansong Zhang

Xu Zhou

Lin Huang

David L Chen

Mengchen Yu

Systems and methods for network traffic metering credit distribution and packet processing in a network device having multiple processing units are provided. According to an embodiment, management of multiple meters is distributed among multiple processing units of a network device. Each meter is implemented in a form of a master entry and a slave entry. Responsive to receipt by one of the processing units of a packet subject to rate-limiting by a meter, an action to be taken on the packet is made with reference to a slave entry managed by the processing unit based on available credit of the slave entry. When the action indicates the packet is to be passed: (i) credits associated with passing the packet are deducted from the available credit; and (ii) the packet is passed to a subsequent stage of packet processing; otherwise, the packet is dropped.

Network traffic metering credit distribution in network device having multiple processing units

Methods and systems for a more efficient transmission of network traffic are provided. According to one embodiment, presence of outbound payload data, distributed across a first and second payload buffer, within a user memory space of a network device that has been generated by a user process is determined by a bus/memory interface or a network interface unit. The payload data is fetched by performing direct virtual memory addressing of the user memory space including mapping virtual addresses of the payload buffers to corresponding physical addresses, including: (i) when the payload buffers are noncontiguous, then retrieving the outbound payload data with reference to multiple buffer descriptors having starting virtual addresses of the payload buffers and (ii) when they are contiguous, then retrieving the outbound payload data with reference to a single buffer descriptor. The outbound payload data is then segmented across one or more TCP packets.

Virtual memory protocol segmentation offloading

Methods and systems for a more efficient transmission of network traffic are provided. According to one embodiment, payload data originated by a user process running on a host processor of a network device is fetched by an interface of the network device by performing direct virtual memory addressing of a user memory space of a system memory of the network device on behalf of a network interface unit of the network device. The direct virtual memory addressing maps physical addresses of various portions of the payload data to corresponding virtual addresses. The payload data is segmented by the network interface unit across one or more packets.

Methods and systems for a more efficient transmission of network traffic are provided. According to one embodiment, payload data originated by a user process running on a host processor of the computer system is fetched by an interface of the computer system by performing direct virtual memory addressing of a user memory space of a system memory of the computer system on behalf of a network processor of the computer system. The direct virtual memory addressing maps a physical address of the payload data to a virtual address. The payload data is segmented by the network processor across one or more packets.

Methods and systems for a more efficient transmission of network traffic are provided. According to one embodiment, a user process of a host processor requests a network driver to store payload data within a system memory. The network driver stores (i) payload buffers each containing therein at least a subset of the payload data and (ii) buffer descriptors each containing therein information indicative of a starting address of a corresponding payload buffer within a user memory space. A network processor transmits onto a network the payload data within multiple transport layer protocol packets by (i) causing a network interface to retrieve the payload data from the payload buffers by performing direct virtual memory addressing of the user memory space using the buffer descriptors and information contained within a translation data structure stored within the system memory; and (ii) segmenting the payload data across the transport layer protocol packets.

Methods and systems for a more efficient transmission of network traffic are provided. According to one embodiment, a method is provided for performing transport layer protocol segmentation offloading. Multiple buffer descriptors are stored in a system memory of a network device. The buffer descriptors contain information indicative of a starting address of a payload buffer stored in a user memory space of the system memory. The payload buffers contain payload data originated by a user process running on a host processor of the network device. The payload data is retrieved from the payload buffers on behalf of a network processor of the network device without copying the payload data from the user memory space to a kernel memory space of the system memory by performing direct virtual memory addressing of the user memory space. Finally, the payload data is segmented across one or more transport layer protocol packets.

Methods and systems for a more efficient transmission of network traffic are provided. According to one embodiment, a method is provided for performing segmentation offloading, such as TCP segmentation offloading (TSO). An interface performs direct virtual memory addressing of a user memory space of a system memory on behalf of a network processor to fetch payload data originated by a user process running on a host processor. Then, the network processor segments the payload data across one or more packets.

Growing community of inventors

Mountain View, CA, United States of America

Guansong Zhang