Direct cache access for network input/output devices
Methods and systems for improving efficiency of direct cache access (DCA) are provided. According to one embodiment, a set of DCA control settings are defined by a network I/O device of a network security device for each of multiple I/O device queues based on network security functionality performed by corresponding CPUs of a host processor. The control settings specify portions of network packets that are to be copied to a cache of the corresponding CPU. A packet is received by the network I/O device. Information associated with the packet is queued onto an I/O device queue. The information is then transferred from the I/O device queue to a host memory of the network security device. Based on the control settings for the I/O device queue only those portions of the information corresponding to the one or more specified portions are copied to the cache of the corresponding CPU.
1. A method comprising:
defining, by a network Input/Output (I/O) device of a network security device, a set of direct cache access (DCA) control settings for each of a plurality of I/O device queues of the network I/O device based on network security functionality performed by corresponding central processing units (CPUs) of a host processor of the network security device, wherein the set of DCA control settings specifies one or more portions of network packets that are to be copied to a cache of the corresponding CPU and wherein the network security functionality comprises one or more of firewall processing, virtual private networking (VPN), antivirus processing, intrusion prevention processing, content filtering, data leak prevention, antispam processing and network access control;
receiving, by the network I/O device, a packet;
queuing, by the network I/O device, information associated with the packet onto an I/O device queue of the plurality of I/O device queues;
transferring, from the I/O device queue, the information associated with the packet to a host memory of the network security device operatively coupled with the host processor; and
based on the set of DCA control settings for the I/O device queue, copying to the cache of the corresponding CPU, by a host controller of the network security device, only those portions of the information corresponding to the one or more specified portions.
2. The method of claim 1 , wherein the one or more specified portions comprise of a packet header, a packet payload, a complete packet or portions thereof.
3. The method of claim 1 , wherein said copying involves transferring those portions of the information corresponding to the one or more specified portions directly from the I/O device queue to the cache.
4. The method of claim 1 , wherein packets are distributed among the plurality of I/O device queues based on one or more of a network interface through which they were received, session details associated with the packets, a distribution policy of the network I/O device and the network security functionality performed by the corresponding CPUs.
5. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network security device, cause the one or more processors to perform a method comprising:
defining a set of direct cache access (DCA) control settings for each of a plurality of I/O device queues of a network I/O device of the network security device based on network security functionality performed by corresponding central processing units (CPUs) of a host processor of the network security device, wherein the set of DCA control settings specifies one or more portions of network packets that are to be copied to a cache of the corresponding CPU and wherein the network security functionality comprises one or more of firewall processing, virtual private networking (VPN), antivirus processing, intrusion prevention processing, content filtering, data leak prevention, antispam processing and network access control;
receiving a packet;
queuing information associated with the packet onto an I/O device queue of the plurality of I/O device queues;
transferring, from the I/O device queue, the information associated with the packet to a host memory of the network security device operatively coupled with the host processor; and
based on the set of DCA control settings for the I/O device queue, copying to the cache of the corresponding CPU only those portions of the information corresponding to the one or more specified portions.
6. The non-transitory computer-readable storage medium of claim 5 , wherein the one or more specified portions comprise of a packet header, a packet payload, a complete packet or portions thereof.
7. The non-transitory computer-readable storage medium of claim 5 , wherein said copying involves transferring those portions of the information corresponding to the one or more specified portions directly from the I/O device queue to the cache.
8. The non-transitory computer-readable storage medium of claim 5 , wherein packets are distributed among the plurality of I/O device queues based on one or more of a network interface through which they were received, session details associated with the packets, a distribution policy of the network I/O device and the network security functionality performed by the corresponding CPUs.
9. The method of claim 1 , further comprising prior to said queuing information associated with the packet onto an I/O device queue, extracting, by the network I/O device, the information associated with the packet by parsing the packet.
10. The method of claim 9 , wherein said parsing is based on protocol information associated with the packet.
11. The method of claim 1 , wherein said queuing, by the network I/O device, information associated with the packet onto an I/O device queue comprises selecting the I/O device queue from among the plurality of I/O device queues based on one or more of a network interface on which the packet was received, session information associated with the packet and the network security functionality performed by the corresponding CPU.
12. The method of claim 1 , wherein said transferring, from the I/O device queue, the information associated with the packet to a host memory comprises causing the information to be queued on a corresponding host queue of a plurality of host queues within the host memory.
13. The non-transitory computer-readable storage medium of claim 5 , wherein the method further comprises prior to said queuing information associated with the packet onto an I/O device queue, extracting the information associated with the packet by parsing the packet.
14. The non-transitory computer-readable storage medium of claim 13 , wherein said parsing is based on protocol information associated with the packet.
15. The non-transitory computer-readable storage medium of claim 5 , wherein said queuing information associated with the packet onto an I/O device queue comprises selecting the I/O device queue from among the plurality of I/O device queues based on one or more of a network interface on which the packet was received, session information associated with the packet and the network security functionality performed by the corresponding CPU.
16. The non-transitory computer-readable storage medium of claim 5 , wherein said transferring, from the I/O device queue, the information associated with the packet to a host memory comprises causing the information to be queued on a corresponding host queue of a plurality of host queues within the host memory.