Default/Exception/Slow Path

In switchdev mode, the flow rules are programmed by the control plane. An exception path is enabled through CP_​VSI to allow a virtual switch like OVS or Linux bridge to receive any packet that does not match any hardware filter and program the flow rules based on the policy configured by the host admin or SDN controller. The packet is also reinjected to the right port. This path is known as the slow path.

Initially by default, the hardware eSwitch has only MAC/VLAN entries. Other configurations and filters are not present on the hardware eSwitch. For every first packet received on the external LAN port, there is no matching flow rule in the hardware eSwitch, so the first packet always follows the Default or exception path through CP_​VSI to reach the software vSwitch (OVS or Linux bridge).

The vSwitch has flow rules configured as per host admin or SDN controller. When a matching flow entry is hit in the software switch control plane (OVS/Linux Bridge), a predefined match action is performed. At the same time, that match/action flow rule is also configured in the hardware eSwitch (classifier engine). This way, a mirror of software control plane/FDB is created in hardware eSwitch.

When the next packet hits the LAN Port, there is a matching entry in the hardware eSwitch's control plane/FDB, and hardware performs the required match action. This enables hardware switching for filter/flows configured in software and is known as the fast path. From this packet onwards, all similar packets go through this fast path (or vSwitch acceleration path).

To support an exception path, CP_​VSI is configured as the default VSI for the eSwitch for all packets received from the VFs. Packets from uplink are directed to the PF_​VSI. Packets received on CP_​VSI are directed to the corresponding VF_​PR netdev based on the Source VSI in the RX descriptor. The PF_​VSI is configured as the default VSI for uplink packets, and the frames received on PF_​VSI are directed to UL_​PR netdev.

Transmits from PR netdevs are treated as directed transmits. Transmits from UL_​PR are directed to the network by setting the switch control tag to indicate uplink packet and bypass any hardware filters.

Exception path for VM-to-VM packets:

VF1_​netdev → VF1_​VSI → eSwitch → CP_​VSI → VF1_​PR netdev → OVS/Linux Bridge → VF2_​PR netdev → CP_​VSI → eSwitch → VF2_​VSI → VF2_​netdev

Exception path for uplink to VM packets:

PF_​netdev → PF_​VSI(H2) → eSwitch(H2) → Uplink(H2) → Uplink(H1) → eSwitch(H1) → PF_​VSI(H1) → UL_​PR netdev → OVS/Linux Bridge → VF1_​PR netdev → CP_​VSI → eSwitch(H1) → VF1_​VSI → VF1 netdev

Exception path for VM to uplink packets:

VF1 netdev → VF1 VSI → eSwitch → CP VSI → UL_​PR netdev → OVS/Linux Bridge → UL_​PR netdev → PF VSI → eSwitch(H1) → Uplink(H1) → Uplink(H2) → eSwitch(H2) → PF VSI → PF netdev