Vmware, Inc.

Nicira, Inc.

Guolin Yang

Boon Seong Ang

Wenyi Jiang

Yong Wang

Jin Heo

Srividya Murali

Ying Gross

Peng T Li

Dexiang Wang

Rajeev Nair

Prerit Rodney

Shrikrishna Khare

Vignesh Raghuraman

Ashwin Mahesh Shroff

Ronak Doshi

Jayant Jain

Xinhua Hong

Jia Yu

Subin Cyriac Mathew

Rishi Mehta

Akshay Katrekar

Ayyappan Veeraiyan

Chi-Hsiang Su

Bhavesh Davda

Xin Xu

Eduard Serra Miralles

Craige Wenyi Jiang

Qing Chang

Peng Li

Some embodiments provide a method of forwarding data messages to a machine that executes on a host computer and has an associated virtual network interface controller (VNIC) also executing on the host computer. The method retrieves data messages from a queue associated with the VNIC and stores these data messages in a first set of buffer data stores associated with the VNIC. When the first buffer set reaches a threshold congestion level, the method stores data messages subsequently retrieved from the VNIC queue in a second set of buffer data stores associated with the VNIC. In some embodiments, a set of one or more processes executing on the machine retrieves the data messages stored in the buffer sets for processing by these processes or other processes.

High throughput ingress datapath for a virtual machine

Some embodiments provide a method for a first smart NIC of multiple smart NICs of a host computer. Each of the smart NICs executes a smart NIC operating system that performs virtual networking operations for a set of data compute machines executing on the host computer. The method receives a data message sent by one of the data compute machines executing on the host computer. The method performs virtual networking operations on the data message to determine that the data message is to be transmitted from a port of a second smart NIC of the multiple smart NICs. The method passes the data message to the second smart NIC via a private communication channel connecting the plurality of smart NICs.

Teaming of smart NICs

Some embodiments of the invention provide a method for configuring a physical network card or physical network controller (pNIC) to provide flow processing offload (FPO) for a host computer connected to the pNIC. The host computers host a set of compute nodes in a virtual network. The set of compute nodes are each associated with a set of interfaces that are each assigned a locally-unique virtual port identifier (VPID) by a flow processing and action generator. The pNIC includes a set of interfaces that are assigned physical port identifiers (PPIDs) by the pNIC. The method includes providing the pNIC with a set of mappings between VPIDs and PPIDs. The method also includes sending updates to the mappings as compute nodes migrate, connect to different interfaces of the pNIC, are assigned different VPIDs, etc. In some embodiments, the flow processing and action generator executes on processing units of the host computer, while in other embodiments, the flow processing and action generator executes on a set of processing units of a pNIC that includes flow processing hardware and a set of programmable processing units.

Configuring pNIC to perform flow processing offload using virtual port identifiers

Described herein are systems, methods, and software to manage the identification of control packets in an encapsulation header. In one implementation, a computing system may receive a Geneve packet at a network interface and determine that the Geneve packet includes an Operations and Management (OAM) flag. Once the OAM flag is identified, the computing system can select a processing queue from a plurality of processing queues for a main processing system of the computing system based on the OAM flag and assign the Geneve packet to the processing queue.

Processing queue assignment based on a flag in a Geneve header

In some embodiments, a method fragments a first packet into a plurality of fragments when a length of an encapsulated first packet is larger than a maximum transmission unit size. For each fragment in the plurality of fragments, fragmentation information is generated. The method encapsulates each fragment in the plurality of fragments with an outer header to form a plurality of encapsulated packets. The respective fragmentation information for each fragment is inserted in a portion of the outer header that is processed by endpoints of an overlay tunnel and not processed by a device along a path of the overlay tunnel. The plurality of encapsulated packets are sent via the overlay tunnel.

Packet fragmentation using outer header

Some embodiments of the invention provide a method for configuring multiple hardware offload units of a host computer to perform operations on packets associated with machines (e.g., virtual machines or containers) executing on the host computer and to pass the packets between each other efficiently. For instance, in some embodiments, the method configures a program executing on the host computer to identify a first hardware offload unit that has to perform a first operation on a packet associated with a particular machine and to provide the packet to the first hardware offload unit. The packet in some embodiments is a packet that the particular machine has sent to a destination machine on the network, or is a packet received from a source machine through a network and destined to the particular machine.

Packet processing with hardware offload units

Some embodiments provide a method for synchronizing state between multiple smart NICs of a host computer that perform operations using dynamic state information. At a first smart NIC of the plurality of smart NICs, the method stores a set of dynamic state information. The method synchronizes the set of dynamic state information across a communication channel that connects the smart NICs so that each of the smart NICs also stores the set of dynamic state information.

State sharing between smart NICs

A method to offload network function packet processing from a virtual machine onto an offload destination is disclosed. In an embodiment, a method comprises: defining an application programing interface ('API') for capturing, in a packet processor offload, a network function packet processing for a data flow by specifying how to perform the network function packet processing on data packets that belong to the data flow. Based on capabilities of the packet processor offload and available resources, a packet processing offload destination is selected. Based at least on the API, the packet processor offload for the packet processing offload destination is generated. The packet processor offload is downloaded to the packet processing offload destination to configure the packet processing offload destination to provide the network function packet processing on the data packets that belong to the data flow. The packet processing offload destination is a PNIC or a hypervisor.

Virtual machine packet processing offload

Some embodiments provide a method for a first smart NIC of multiple smart NICs of a host computer. Each of the smart NICs is for performing virtual networking operations for a set of data compute machines executing on the host computer. The method determines that the first smart NIC is elected to communicate with a network management and control system that configures the virtual networking operations. The method receives a set of configuration data for the virtual networking operations from the network management and control system. The method provides the received set of configuration data to the other smart NICs of the host computer.

Smart NIC leader election

Example methods and systems for logical network packet handling are described. In one example, a physical network interface controller (PNIC) may receive an egress packet associated with a packet flow via a first virtual function supported by the PNIC. The PNIC may steer the egress packet towards a processing pipeline by applying a filter associated with the first virtual function or content of the egress packet, or both. The egress packet may be processed using the processing pipeline to generate a processed packet by (a) retrieving a logical network policy associated with the packet flow from a datastore on the PNIC and (b) performing one or more actions according to the logical network policy. The processed packet may be forwarded towards the destination via a second virtual function supported by the PNIC or a physical network connected to the PNIC.

Logical network packet handling on physical network interface controller (PNIC)

The disclosure provides an approach for segmenting a user datagram protocol (UDP) packets. A method includes generating the UDP packet, containing UDP data, at a virtual computing instance (VCI) running on a host machine; sending the UDP packet from the VCI to a hypervisor running on the host machine; after sending the UDP packet to the hypervisor, segmenting the UDP packet into a plurality of UDP segments, wherein each of the plurality of UDP segments includes a portion of the UDP data and a UDP header; and transmitting the plurality of UDP segments, over a network, to a destination of the UDP packet.

User datagram protocol segmentation offload for virtual machines

Configuring PNIC to perform flow processing offload using virtual port identifiers

Example methods and systems for logical network packet handling are described. In one example, a physical network interface controller (PNIC) may receive an ingress encapsulated packet associated with a packet flow via a physical network. The ingress encapsulated packet may include an outer header and an inner packet that is destined for a virtualized computing instance. The ingress encapsulated packet may be steered towards a processing pipeline for processing to generate a processed packet. The processing pipeline may include (a) retrieving a logical network policy associated with the packet flow from a datastore on the PNIC; and (b) performing decapsulation to remove the outer header and one or more actions on the inner packet according to the logical network policy. The processed packet may be forwarded towards the virtualized computing instance via a virtual function supported by the PNIC or a physical network connected to the PNIC.

Some embodiments of the invention provide a method of upgrading software defined networking (SDN) modules executing on a host computer. While a first version of the SDN modules is executing on the host computer to perform traffic processing, the method loads a second version of the SDN modules alongside the first version of the SDN modules such that the first and second versions of the SDN modules are executing on the host computer at the same time. The method saves runtime states from the first version of the SDN modules, and transfers responsibility for performing traffic processing from the first version of the SDN modules to the second version of the SDN modules. The method then restores the saved runtime states to the second version of the SDN modules.

Upgrading SDN software by dual-loading modules

Some embodiments of the invention provide a method of upgrading a firewall module executing on a host computer to process traffic sent to and from machines executing on the host computer. While a first version of the firewall module executes on the host computer to process the traffic to and from the machines, the method loads a second version of the firewall module alongside the first version of the firewall module. For each of multiple ports associated with machines executing on the host computer for which the firewall module processes traffic sent to and from the port, the method saves a runtime state of the first version that relates to the port, transfers association of a firewall filter associated with the port from the first version to the second version, and restores the saved runtime state for the port to the second version.

Growing community of inventors

San Jose, CA, United States of America

Guolin Yang