Frameworks and interfaces for offload device-based packet processing

Patent metadata

Field	Value
Publication number	US-2016110214-A1
Application number	US-201514923276-A
Country	US
Kind code	A1
Filing date	Oct 26, 2015
Priority date	Mar 30, 2011
Publication date	Apr 21, 2016
Grant date	—

Abstract

High-speed processing of packets to, and from, a virtualization environment can be provided while utilizing hardware-based segmentation offload and other such functionality. A hardware vendor such as a network interface card (NIC) manufacturer can enable the hardware to support open and proprietary stateless tunneling in conjunction with a protocol such as single root I/O virtualization (SR-IOV) in order to implement a virtualized overlay network. The hardware can utilize various rules, for example, that can be used by the NIC to perform certain actions, such as to encapsulate egress packets and decapsulate packets.

First claim

1 . (canceled)

2 . A method, comprising:
determining, using a Virtual Machine Manager (VMM) hosted in a computing system, if a virtual machine hosted in the computing system is configured to communicate with an offload device of the computing system using a single root I/O virtualization (SR-IOV) interface; upon determining that the virtual machine is not configured to access functionality of the offload device, transmitting a first set of driver instructions into the virtual machine, wherein the first set of driver instructions, when executed by the virtual machine, enables the virtual machine to communicate with the offload device to access functionality of the offload device using the SR-IOV interface.

3 . The method of claim 2 , further comprising:
communicating, using the virtual machine, with a distributed service to load a per-tenant network specification; and instructing, using the virtual machine, the offload device to execute the loaded per-tenant network specification.

4 . The method of claim 2 , wherein the offload device and the virtual machine communicate using a Direct Memory Access (DMA) mechanism.

5 . The method of claim 2 , wherein the offload device is configured to encapsulate data into network frames or to de-encapsulate network frames.

6 . An apparatus, comprising:
a computing system configured to host a first virtual machine; a first offload device; and memory, including operating instructions that, when executed by the computing system, enable the computing system to transmit a first set of driver instructions to the first virtual machine that, when executed by the first virtual machine, alters the format of data transmitted between the first virtual machine and the first offload device to conform to a first protocol.

7 . The apparatus of claim 6 , wherein the first protocol is a communication protocol of the first offload device.

8 . The apparatus of claim 6 , wherein the first set of driver instructions are transmitted by a Virtual Machine Manager (VMM) of the computing system.

9 . The apparatus of claim 8 , wherein the VMM is configured to dynamically transmit the set of driver instructions after determining that the first virtual machine is not configured to execute instructions that enable the first virtual machine to access a function of the first offload device.

10 . The apparatus of claim 6 , wherein the computing system is further configured to host a second virtual machine, wherein the first virtual machine and the second virtual machine are configured to communicate with offload devices using a single, common protocol different from the first protocol.

11 . The apparatus of claim 10 , wherein the operating instructions, when executed by the computing system, further enable the computing system to:
transmit a second set of driver instructions into the second virtual machine, wherein the second set of driver instructions, when executed by the second virtual machine, enable the second virtual machine to communicate with a second offload device using a second protocol, wherein the first protocol is different from the second protocol.

12 . The apparatus of claim 10 , wherein the operating instructions, when executed by the computing system, further enable the computing system to:
communicate with a distributed service to load a per-tenant network specification; and instruct the first offload device to execute the loaded per-tenant network specification.

13 . The apparatus of claim 6 , wherein the first offload device and the first virtual machine are configured to communicate using a Direct Memory Access (DMA) mechanism.

14 . The apparatus of claim 6 , wherein the first offload device and the first virtual machine are configured to communicate over a Peripheral Component Interconnect or Peripheral Component Interconnect Express interface.

15 . The apparatus of claim 6 , wherein the offload device is configured to encapsulate data into network frames or to de-encapsulate network frames to conform to an ethernet protocol.

16 . A method, comprising:
storing, in a computing system hosting a virtualized environment, a plurality of drivers each associated with a function of an offload device; determining, by a Virtual Machine Manager (VMM) of the computing system, if a guest virtual machine coupled to the VMM lacks a driver of the plurality of drivers to used implement a first function of the offload device; selecting, by the VMM, a first driver of the plurality of drivers associated with the first function; and injecting, by the VMM, the first driver into the guest virtual machine to enable the first function to be accessed by the guest virtual machine.

17 . The method of claim 16 , further comprising:
communicating, using the computing system, with a distributed service to load a per-tenant network specification; and instructing, using the computing system, the offload device to execute the loaded per-tenant network specification.

18 . The method of claim 16 , wherein the offload device is a single root I/O virtualization (SR-IOV) compatible device and the function is a virtual function or a physical function of the offload device.

19 . The method of claim 16 , wherein the virtual machine is one of a plurality of virtual machines of the computing system and each of the virtual machines is configured to communicate using a common protocol with the offload device.

20 . The method of claim 19 , wherein each driver of the plurality of drivers is configured to communicate with each of the virtual machines using the common protocol and the associated function of the offload device using a different protocol.

21 . The method of claim 16 , further comprising:
determining, by the VMM, if the guest virtual machine lacks a second driver of the plurality of drivers to implement a second function of an offload device; selecting, by the VMM, the second driver associated with the second function; and injecting, by the VMM, the second driver into the guest virtual machine to enable the second function to be accessed by the guest virtual machine.

Assignees

• Amazon Tech Inc

Inventors

• Vincent Pradeep
• Klein Matthew David
• Mckelvie Samuel James

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L45/74

  Address processing for routing · CPC title

• H04L12/4633 Primary

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title