Bandwidth-control policers in a network adapter

1. A network adapter of a host in a system that includes client nodes, the network adapter comprising:

a network interface configured to be connected to a network;

a host interface configured to communicate with a host processor of the host, the host processor running multiple application programs that enforce bandwidth-control policies on packets communicated between the client nodes and target nodes in the network; and

processing circuitry comprising one or more bandwidth-control policers that are configured to apply the bandwidth-control policies specified by each of the multiple application programs, wherein each application program is configured to separately specify a bandwidth-control policer of the one or more bandwidth-control policers, the processing circuitry configured to:

receive from the network, via the network interface, a packet that

(i) is communicated between one of the client nodes and a target node in the network, and

(ii) is subject to a given bandwidth-control policy enforced by a given application program of the multiple application programs;

select, based on the packet, a bandwidth-control policer supporting the given bandwidth-control policy from among the bandwidth-control policers comprised in the network adapter;

apply the given bandwidth-control policy to the packet, as specified by the given application program, using the selected bandwidth-control policer, to produce a policer result; and

further process the packet based at least on the policer result, including at least selectively forwarding the packet.

2. The network adapter according to claim 1 , wherein, in further processing the packet, the processing circuitry is configured to apply to the packet a given action based on the policer result.

3. The network adapter according to claim 2 , wherein the given action is selected from a list of actions comprising: marking the packet, dropping the packet, mirroring the packet, counting the packet for metering, and proceeding to another match-action table.

4. The network adapter according to claim 1 , wherein the processing circuitry is configured to associate the packet with the selected bandwidth-control policer in response to matching the packet to an action in a match-action table.

5. The network adapter according to claim 1 , wherein the processing circuitry is configured to match the packet, in a match-action table associated with the packet, to an action that specifies a forwarding scheme for sending the packet to the given application program, and to forward the packet to the given application program based on the forwarding scheme.

6. The network adapter according to claim 1 , wherein the processing circuitry is configured to match the packet in a first match-action table to a first action, to apply the first action to the packet, to further match the packet in a second match-action table to a second action, and to apply the second action to the packet.

7. The network adapter according to claim 1 , wherein the processing circuitry is configured to associate with the packet another different bandwidth-control policer selected from among the bandwidth-control policers comprised in the network adapter, and to apply to the packet a bandwidth-control policy supported by the another bandwidth-control policer to produce another policer result.

8. The network adapter according to claim 1 , wherein the processing circuitry is configured to retrieve a policer context associated with the packet from a memory accessible by the processing circuitry, and to apply the given bandwidth-control policy to the packet using the policer context.

9. The network adapter according to claim 1 , wherein the given application program is selected from a list of application programs comprising: a Virtual Machine (VM), a hypervisor controlling one or more VMs, a Virtual Network Function (VNF), a container, and a non-virtualized application program.

10. The network adapter according to claim 1 , wherein the processing circuitry is configured to associate the bandwidth-control policer with the packet independently from association of packets destined to other application programs with respective bandwidth-control policers.

11. A method, comprising:

in a network adapter of a host in a system that includes client nodes, wherein the network adapter is connected to a network and to a host comprising a host processor that runs multiple application programs that enforce bandwidth-control policies on packets communicated between the client nodes and target nodes in the network, wherein the network adapter comprises one or more bandwidth-control policers that are configured to apply the bandwidth-control policies specified by each of the multiple application programs, wherein each application program is configured to separately specify a bandwidth-control policer of the one or more bandwidth-control policers,

receiving from the network a packet that

(i) is communicated between one of the client nodes and a target node in the network, and

(ii) is subject to a given bandwidth-control policy enforced by a given application program of the multiple application programs;

selecting, based on the packet, a bandwidth-control policer supporting the given bandwidth-control policy from among the bandwidth-control policers comprised in the network adapter;

applying the given bandwidth-control policy to the packet, as specified by the given application program, using the selected bandwidth-control policer, to produce a policer result; and

further processing the packet based at least on the policer result, including at least selectively forwarding the packet.

12. The method according to claim 11 , wherein further processing the packet comprises applying to the packet a given action based on the policer result.

13. The method according to claim 12 , wherein the given action is selected from a list of actions comprising: marking the packet, dropping the packet, mirroring the packet, counting the packet for metering, and proceeding to another match-action table.

14. The method according to claim 11 , and comprising associating the packet with the selected bandwidth-control policer in response to matching the packet to an action in a match-action table.

15. The method according to claim 11 , and comprising matching the packet in a match-action table associated with the packet, to an action that specifies a forwarding scheme for sending the packet to the given application program, and forwarding the packet to the given application program based on the forwarding scheme.

16. The method according to claim 11 , and comprising, matching the packet in a first match-action table to a first action, applying the first action to the packet, further matching the packet in a second match-action table to a second action, and applying the second action to the packet.

17. The method according to claim 11 , and comprising associating with the packet another different bandwidth-control policer selected from among the bandwidth-control policers comprised in the network adapter, and applying to the packet a bandwidth-control policy supported by the another bandwidth-control policer to produce another policer result.

18. The method according to claim 11 , and comprising retrieving a policer context associated with the packet from a memory accessible by the processing circuitry, and applying the given bandwidth-control policy to the packet using the policer context.

19. The method according to claim 11 , wherein the given application program is selected from a list of application programs comprising: a Virtual Machine (VM), a hypervisor controlling one or more VMs, a Virtual Network Function (VNF), a container, and a non-virtualized application program.

20. The method according to claim 11 , and comprising associating the bandwidth-control policer with the packet independently from association of packets destined to other application programs with respective bandwidth-control policers.

21. A network adapter of a host in a system that includes client nodes, the network adapter comprising:

a network interface configured to be connected to a network;

a host interface configured to communicate with a host processor of the host, the host processor running multiple application programs that enforce bandwidth-control policies on packets communicated between the client nodes and target nodes in the network; and

processing circuitry comprising one or more bandwidth-control policers that are configured to apply the bandwidth-control policies specified by the multiple application programs, the processing circuitry configured to:

receive from the network, via the network interface, a packet that (i) is communicated between one of the client nodes and a target node in the network, and (ii) is subject to a given bandwidth-control policy enforced by a given application program of the multiple application programs;

select, based on the packet, a bandwidth-control policer supporting the given bandwidth-control policy from among the bandwidth-control policers comprised in the network adapter; and

apply the given bandwidth-control policy to the packet, as specified by the given application program, using the selected bandwidth-control policer.

22. The network adapter according to claim 21 , wherein the processing circuitry is configured to apply to the packet a given action based on a result of the given bandwidth-control policy.

23. The network adapter according to claim 22 , wherein the given action is selected from a list of actions comprising: marking the packet, dropping the packet, forwarding the packet, mirroring the packet, counting the packet for metering, and proceeding to another match-action table.

24. The network adapter according to claim 21 , wherein the processing circuitry is configured to select the bandwidth-control policer by matching the packet to an action in a match-action table.