Enforcing scheduling policies with software schedulers at end-hosts leads to high CPU consumption, low throughput, and inaccuracies. To address these issues, offloading packet schedulers to the network interface card presents a promising research direction. However, existing attempts suffer from inflexible on-NIC scheduling that cannot execute complex hierarchies of network policies. In this article, we propose FlowValve+, a general framework for multi-queue packet scheduling on SoC-based SmartNICs. The key insight behind FlowValve+is to abstract the inherent queueing system as a single FIFO queue and perform specialized tail drop to mix the FIFO queue with expected flow proportions. FlowValve+leverages hardware accelerations to produce high throughput while substantially reducing CPU and memory usage on end-hosts. We prototype FlowValve+on Netronome Agilio 40GbE and NVIDIA Bluefield-2 100GbE SmartNICs to demonstrate its ability to accurately enforce network policies while driving TCP traffic at 40 Gbps and 80 Gbps on both platforms, respectively. Moreover, FlowValve+can save two CPU cores compared to DPDK packet schedulers.

Reliable Software-Defined Networking (SDN) should mitigate forwarding anomalies due to cross-plane rule inconsistencies. Most existing countermeasures either inject probe packets to infer forwarding correctness or collect packet traces to detect forwarding anomalies. They, however, cannot detect or filter forwarding anomalies for production packets in real time. In this paper, we propose RuleOut as the first attempt to automatically throttle SDN forwarding anomalies. It disambiguates dependent rules via augmenting their matching fields with unique tags. Leveraging source routing, we further bind each packet with the tag sequence corresponding to rules the packet should match. RuleOut thus renders each packet to match at most one rule on each switch. This completely addresses the root cause of forwarding ambiguity. To implement RuleOut, we develop a non-overlapping rule dependency graph, a series of algorithms for incremental rule update and tag generation upon it, and various optimization techniques toward scalability and efficiency. We prototype RuleOut on the Ryu controller and Open vSwitch and evaluate its performance over public rule sets such as Stanford, Internet2, and Airtel1. RuleOut can use tags of only several bits long to disambiguate thousands to millions of rules and generate tags fairly fast within a few milliseconds.

Enforcing scheduling policies at end-hosts with software schedulers suffers from high CPU consumption, low throughput, and inaccuracy. Offloading scheduling functions to the network interface card (NIC) provides a promising direction to address these problems. However, existing efforts in scheduling offloading suffer from inflexible on-NIC packet schedulers, which cannot execute complex hierarchies of network policies. In this paper, we present FlowValve, the first parallel packet scheduler for Network Processor (NP)-based SmartNICs that offloads critical functions of Linux traffic control, including packet classifying and scheduling. The key insight behind FlowValve is to abstract inherent queues attached to the NIC interface (wire side) as a single FIFO queue and perform specialized tail drop to mix the FIFO queue with expected flow proportions. FlowValve takes advantage of on-chip multi-core parallelism and hardware accelerations to produce high throughput. Meanwhile, it substantially reduces CPU and memory burdens on end-hosts. We prototype FlowValve on a Netronome Agilio SmartNIC and demonstrate its effectiveness against non-offloaded kernel schedulers and DPDK QoS Scheduler. We find that FlowValve outperforms both in accurately enforcing network policies while driving line rate performance (i.e., 40Gbps), which contributes to saving at least two CPU cores.