FRAMEWORKS AND INTERFACES FOR OFFLOAD DEVICE-BASED PACKET PROCESSING

• US 20160110214A1
• Filed: 10/26/2015
• Published: 04/21/2016
• Est. Priority Date: 03/30/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Vincent, Pradeep, Klein, Matthew David, McKelvie, Samuel James
• Granted Patent: US 9,904,568 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

High-speed processing of packets to, and from, a virtualization environment can be provided while utilizing hardware-based segmentation offload and other such functionality. A hardware vendor such as a network interface card (NIC) manufacturer can enable the hardware to support open and proprietary stateless tunneling in conjunction with a protocol such as single root I/O virtualization (SR-IOV) in order to implement a virtualized overlay network. The hardware can utilize various rules, for example, that can be used by the NIC to perform certain actions, such as to encapsulate egress packets and decapsulate packets.

Claims

1. (canceled)

2. A method, comprising:

determining, using a Virtual Machine Manager (VMM) hosted in a computing system, if a virtual machine hosted in the computing system is configured to communicate with an offload device of the computing system using a single root I/O virtualization (SR-IOV) interface;

upon determining that the virtual machine is not configured to access functionality of the offload device, transmitting a first set of driver instructions into the virtual machine, wherein the first set of driver instructions, when executed by the virtual machine, enables the virtual machine to communicate with the offload device to access functionality of the offload device using the SR-IOV interface.

3. The method of claim 2, further comprising:

communicating, using the virtual machine, with a distributed service to load a per-tenant network specification; and

instructing, using the virtual machine, the offload device to execute the loaded per-tenant network specification.

4. The method of claim 2, wherein the offload device and the virtual machine communicate using a Direct Memory Access (DMA) mechanism.

5. The method of claim 2, wherein the offload device is configured to encapsulate data into network frames or to de-encapsulate network frames.

6. An apparatus, comprising:

a computing system configured to host a first virtual machine;

a first offload device; and

memory, including operating instructions that, when executed by the computing system, enable the computing system to transmit a first set of driver instructions to the first virtual machine that, when executed by the first virtual machine, alters the format of data transmitted between the first virtual machine and the first offload device to conform to a first protocol.

7. The apparatus of claim 6, wherein the first protocol is a communication protocol of the first offload device.

8. The apparatus of claim 6, wherein the first set of driver instructions are transmitted by a Virtual Machine Manager (VMM) of the computing system.

9. The apparatus of claim 8, wherein the VMM is configured to dynamically transmit the set of driver instructions after determining that the first virtual machine is not configured to execute instructions that enable the first virtual machine to access a function of the first offload device.

10. The apparatus of claim 6, wherein the computing system is further configured to host a second virtual machine, wherein the first virtual machine and the second virtual machine are configured to communicate with offload devices using a single, common protocol different from the first protocol.

11. The apparatus of claim 10, wherein the operating instructions, when executed by the computing system, further enable the computing system to:

transmit a second set of driver instructions into the second virtual machine, wherein the second set of driver instructions, when executed by the second virtual machine, enable the second virtual machine to communicate with a second offload device using a second protocol, wherein the first protocol is different from the second protocol.

12. The apparatus of claim 10, wherein the operating instructions, when executed by the computing system, further enable the computing system to:

communicate with a distributed service to load a per-tenant network specification; and

instruct the first offload device to execute the loaded per-tenant network specification.

13. The apparatus of claim 6, wherein the first offload device and the first virtual machine are configured to communicate using a Direct Memory Access (DMA) mechanism.

14. The apparatus of claim 6, wherein the first offload device and the first virtual machine are configured to communicate over a Peripheral Component Interconnect or Peripheral Component Interconnect Express interface.

15. The apparatus of claim 6, wherein the offload device is configured to encapsulate data into network frames or to de-encapsulate network frames to conform to an ethernet protocol.

16. A method, comprising:

storing, in a computing system hosting a virtualized environment, a plurality of drivers each associated with a function of an offload device;

determining, by a Virtual Machine Manager (VMM) of the computing system, if a guest virtual machine coupled to the VMM lacks a driver of the plurality of drivers to used implement a first function of the offload device;

selecting, by the VMM, a first driver of the plurality of drivers associated with the first function; and

injecting, by the VMM, the first driver into the guest virtual machine to enable the first function to be accessed by the guest virtual machine.

17. The method of claim 16, further comprising:

communicating, using the computing system, with a distributed service to load a per-tenant network specification; and

instructing, using the computing system, the offload device to execute the loaded per-tenant network specification.

18. The method of claim 16, wherein the offload device is a single root I/O virtualization (SR-IOV) compatible device and the function is a virtual function or a physical function of the offload device.

19. The method of claim 16, wherein the virtual machine is one of a plurality of virtual machines of the computing system and each of the virtual machines is configured to communicate using a common protocol with the offload device.

20. The method of claim 19, wherein each driver of the plurality of drivers is configured to communicate with each of the virtual machines using the common protocol and the associated function of the offload device using a different protocol.

21. The method of claim 16, further comprising:

determining, by the VMM, if the guest virtual machine lacks a second driver of the plurality of drivers to implement a second function of an offload device;

selecting, by the VMM, the second driver associated with the second function; and

injecting, by the VMM, the second driver into the guest virtual machine to enable the second function to be accessed by the guest virtual machine.