Efficient packet handling, redirection, and inspection using offload processors
A packet handling system is disclosed that can include at least one main processor; a plurality of offload processors connected to a memory bus and configured to provide security related services on packets prior to redirection to the main processor; and a virtual switch respectively connected to the main processor and the plurality of offload processors using the memory bus, the virtual switch configured to receive memory read/write data over the memory bus.
1. A packet handling system, comprising:
a system memory;
a memory controller coupled to a memory bus;
at least one main processor in communication with the system memory by operation of the memory controller;
at least one hardware module physically connected to the memory bus that includes
a virtual switch in communication with the main processor and a plurality of offload processors over the memory bus by operation of the memory controller, the virtual switch configured to receive packet data as writes to the system memory by the memory controller, and to transmit packet data as reads from system memory by the memory controller, and
the plurality of offload processors are connected to the memory bus and configured to provide security related services on packet data and allow the packet data to be transmitted to the main processor after the security related services have been completed; and
a network interface card, configured to receive the packet data and direct the packet data to the virtual switch by operation of the memory controller; wherein
the memory controller, the memory bus, and the at least one main processor are not included in the at least one hardware module.
2. The packet handling system of claim 1 , wherein the offload processors are configured to support signature detection by an intrusion prevention system.
3. The packet handling system of claim 1 , wherein the offload processors are configured to support encryption/decryption.
4. The packet handling system of claim 1 , further comprising an input-out memory management unit (IOMMU); wherein the IOMMU is configured to pass the packet data from the network interface card to the virtual switch.
5. The packet handling system of claim 4 , wherein the network interface card includes single root IO virtualization (SR-IOV).
6. The packet handling system of claim 1 , wherein the offload processors are connected to a module memory mounted on the at least one hardware module, and further include a snoop control unit for coherent read out and write in to the module memory.
7. The packet handling system of claim 1 , wherein the offload processors are connected to a module memory mounted on the at least one hardware module and configured for zero-overhead context switching between threads of a networked application.
8. The packet handling system of claim 1 , wherein the offload processors are connected to a module memory and a computational field programmable gate array (FPGA), all mounted together on an in-line module configured for insertion into a dual-in-line-memory-module (DIMM) socket.