GENERIC COMMUNICATION CHANNEL FOR INFORMATION EXCHANGE BETWEEN A HYPERVISOR AND A VIRTUAL MACHINE

• US 20190273683A1
• Filed: 03/01/2018
• Published: 09/05/2019
• Est. Priority Date: 03/01/2018
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: JIANG, Caixia, SHEN, Jianjun, GHAG, Aditi, LIU, Danting, CHANG, Hongshun, HAN, Donghai, CHEREPANOV, Vladimir
• Granted Patent: US 10,454,824 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4645 Details on frame tagging routing of packets H04L45/00; support for virtual LAN H04L49/354
• CPC Class Codes: H04L 2012/445 with switching in a hub, e.g. ETHERNET switch
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2525 Translation at a client
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5038 for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]

Abstract

Certain embodiments described herein are generally directed to configuring a generic channel for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on a host machine. In some embodiments, the generic channel represents a network or communication path enabled by a logical switch that connects a HyperBus running on the hypervisor and a node agent running on the virtual machine. In some embodiments, network traffic handled by the generic channel is isolated from incoming and outgoing network traffic between the virtual machine and one or more other virtual machines or hosts.

Claims

1. A method for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on a host machine, comprising:

receiving, at a first daemon running on the hypervisor, information from a network control plane, wherein the information is destined for a second daemon running inside the virtual machine;

generating, at the first daemon, a packet having a payload including at least a portion of the information and a header including a source internet protocol (IP) address of the first daemon, a source media access control (MAC) address of the first daemon, a first destination IP address associated with the second daemon, and a destination MAC address of the second daemon;

storing a first identifier in metadata associated with the packet;

receiving, at a first port of a first virtual switch implemented by the hypervisor, the packet from the first daemon, the first daemon being coupled to the first port;

determining, at the first virtual switch, to forward the packet to a second port of the first virtual switch based on the first identifier, the destination MAC address, and the first destination IP address, wherein the second port is configured to pass packets associated with the first identifier;

tagging, at the first virtual switch, the packet with a second identifier based on a mapping of the first identifier to the second identifier;

transmitting the packet, at the second port of the first virtual switch, to a virtual network interface card (VNIC) of the virtual machine, wherein the VNIC is coupled to the second port;

passing, at the VNIC, the packet to a second virtual switch implemented by the virtual machine;

determining, at the second virtual switch, to forward the packet to a port on the second virtual switch based on the second identifier, the destination MAC address, and a second destination IP address, wherein the port is configured to pass packets associated with the second identifier, wherein the second daemon is coupled to the port; and

receiving the packet at the second daemon over the port.

2. The method of claim 1, wherein the first identifier comprises a virtual extensible local area network ID (VXLAN ID), wherein the second identifier comprises a virtual local area network ID (VLAN ID) associated with a VLAN for connecting the first daemon and the second daemon.

3. The method of claim 1, wherein the information comprises network interface configuration information of a container, the method further comprising:

collecting, at a node agent, the information from the second daemon; and

configuring a network interface of the container using the information.

4. The method of claim 3, wherein after the configuring, traffic associated with the container is communicated by the first virtual switch to the VNIC of the virtual machine using a port different than the second port.

5. The method of claim 1, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein each copy of the second daemon is configured with the second destination IP address, the second destination IP address being different than the first destination IP address;

the method further comprising;

performing network address translation, at the second port of the first virtual switch, to replace the first destination IP address of the second daemon with the second destination IP address of the second daemon, prior to the transmitting.

6. The method of claim 1, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein the plurality of virtual machines are in an isolated private local area network (PVLAN) port group, and wherein the first daemon is in a promiscuous PVLAN port group.

7. The method of claim 1, wherein the first daemon generates and allocates the first destination IP address associated with the second daemon.

8. The method of claim 1, wherein the first daemon uses a network stack in the hypervisor that is different than a network stack in the hypervisor that handles networking for traffic communicated between the virtual machine and one or more other virtual machines running on the hypervisor and traffic communicated between the virtual machine and one or more other hosts.

9. The method of claim 1, wherein the first virtual switch is configured to drop packets upon determining that a rate at which the virtual machine is sending packets to the first daemon exceeds a threshold.

10. The method of claim 1, wherein the second daemon is prevented from initiating a connection with the first daemon.

11. The method of claim 1, wherein the first destination IP address is the same as the second destination IP address.

12. A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on the computer system, the method comprising:

receiving, at a first daemon running on the hypervisor, information from a network control plane, wherein the information is destined for a second daemon running inside the virtual machine;

generating, at the first daemon, a packet having a payload including at least a portion of the information and a header including a source internet protocol (IP) address of the first daemon, a source media access control (MAC) address of the first daemon, a first destination IP address associated with the second daemon, and a destination MAC address of the second daemon;

storing a first identifier in metadata associated with the packet;

receiving, at a first port of a first virtual switch implemented by the hypervisor, the packet from the first daemon, the first daemon being coupled to the first port;

determining, at the first virtual switch, to forward the packet to a second port of the first virtual switch based on the first identifier, the destination MAC address, and the first destination IP address, wherein the second port is configured to pass packets associated with the first identifier;

tagging, at the first virtual switch, the packet with a second identifier based on a mapping of the first identifier to the second identifier;

transmitting the packet, at the second port of the first virtual switch, to a virtual network interface card (VNIC) of the virtual machine, wherein the VNIC is coupled to the second port;

passing, at the VNIC, the packet to a second virtual switch implemented by the virtual machine;

determining, at the second virtual switch, to forward the packet to a port on the second virtual switch based on the second identifier, the destination MAC address, and a second destination IP address, wherein the port is configured to pass packets associated with the second identifier, wherein the second daemon is coupled to the port; and

receiving the packet at the second daemon over the port.

13. The non-transitory computer readable medium of claim 12, wherein the first identifier comprises a virtual extensible local area network ID (VXLAN ID), wherein the second identifier comprises a virtual local area network ID (VLAN ID) associated with a VLAN for connecting the first daemon and the second daemon.

14. The non-transitory computer readable medium of claim 12, wherein the information comprises network interface configuration information of a container, the method further comprising:

collecting, at a node agent, the information from the second daemon; and

configuring a network interface of the container using the information, wherein after the configuring, traffic associated with the container is communicated by the first virtual switch to the VNIC of the virtual machine using a port different than the second port.

15. The non-transitory computer readable medium of claim 12, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein each copy of the second daemon is configured with the second destination IP address, the second destination IP address being different than the first destination IP address;

the method further comprising;

performing network address translation, at the second port of the first virtual switch, to replace the first destination IP address of the second daemon with the second destination IP address of the second daemon, prior to the transmitting.

16. The non-transitory computer readable medium of claim 12, wherein the first daemon generates and allocates the first destination IP address associated with the second daemon.

17. A computer system, wherein system software for the computer system is programmed to execute a method for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on the computer system, the method comprising:

receiving, at a first daemon running on the hypervisor, information from a network control plane, wherein the information is destined for a second daemon running inside the virtual machine;

generating, at the first daemon, a packet having a payload including at least a portion of the information and a header including a source internet protocol (IP) address of the first daemon, a source media access control (MAC) address of the first daemon, a first destination IP address associated with the second daemon, and a destination MAC address of the second daemon;

storing a first identifier in metadata associated with the packet;

receiving, at a first port of a first virtual switch implemented by the hypervisor, the packet from the first daemon, the first daemon being coupled to the first port;

determining, at the first virtual switch, to forward the packet to a second port of the first virtual switch based on the first identifier, the destination MAC address, and the first destination IP address, wherein the second port is configured to pass packets associated with the first identifier;

tagging, at the first virtual switch, the packet with a second identifier based on a mapping of the first identifier to the second identifier;

transmitting the packet, at the second port of the first virtual switch, to a virtual network interface card (VNIC) of the virtual machine, wherein the VNIC is coupled to the second port;

passing, at the VNIC, the packet to a second virtual switch implemented by the virtual machine;

determining, at the second virtual switch, to forward the packet to a port on the second virtual switch based on the second identifier, the destination MAC address, and a second destination IP address, wherein the port is configured to pass packets associated with the second identifier, wherein the second daemon is coupled to the port; and

receiving the packet at the second daemon over the port.

18. The computer system of claim 17, wherein the first identifier comprises a virtual extensible local area network ID (VXLAN ID), wherein the second identifier comprises a virtual local area network ID (VLAN ID) associated with a VLAN for connecting the first daemon and the second daemon.

19. The computer system of claim 17, wherein the information comprises network interface configuration information of a container, the method further comprising:

collecting, at a node agent, the information from the second daemon; and

configuring a network interface of the container using the information, wherein after the configuring, traffic associated with the container is communicated by the first virtual switch to the VNIC of the virtual machine using a port different than the second port.

20. The computer system of claim 17, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein each copy of the second daemon is configured with the second destination IP address, the second destination IP address being different than the first destination IP address;

the method further comprising;

performing network address translation, at the second port of the first virtual switch, to replace the first destination IP address of the second daemon with the second destination IP address of the second daemon, prior to the transmitting.

21. The computer system of claim 17, wherein the first daemon generates and allocates the first destination IP address associated with the second daemon.