Cavium, Inc.

Marvell Asia Pte., Ltd.

Manojkumar Panicker

Faisal Masood

Richard Eugene Kessler

Muhammad Raghib Hussain

Vishal Murgai

Brian Folsom

Ram Kumar Manapragada

Venkat Koppula

Satish Kikkeri

A new approach is proposed that contemplates systems and methods to support virtio-based data packet path optimization for live virtual machine (VM) migration for Linux. Specifically, a data packet receiving (Rx) path and a data packet transmitting (Tx) path between a VM running on a host and a virtual function (VF) driver configured to interact with a physical network device of the host to receive and transmit communications dedicated to the VM are both optimized to implement a zero-copy solution to reduce overheads in packet processing. Under the proposed approach, the data packet Tx path utilizes a zero-copy mechanism provided by Linux kernel to avoid copying from virtio memory rings/Tx vrings in memory of the VM. The data packet Rx path also implements a zero-copy solution, which allows a virtio device of the VM to communicate directly with the VF driver of the network device while bypassing a macvtap driver entirely from the data packet Rx path.

Systems and methods for virtio based optimization of data packet paths between a virtual machine and a network device for live virtual machine migration

A new approach is proposed that contemplates systems and methods to support a mechanism to offload IPSec/IKE processing of virtual machines (VMs) running on a host to an embedded networking device, which serves as a hardware accelerator for the VMs that need to have secured communication with a remote device/server over a network. By utilizing a plurality of its software and hardware features, the embedded networking device is configured to perform all offloaded IPSec operations on data packets transferred between the host and the remote device over the network as required for the secured communication before the data packets can be transmitted over the network. The embedded networking device, in effect, acts as a proxy on behalf of the VMs running on the host to perform the offloaded IPSec operations as well as serving as the network interface for the secured communication between the VMs and the remote device.

Systems and methods for offloading IPSEC processing to an embedded networking device

A new approach is proposed that contemplates systems and methods to support a mechanism to offload all aspects of inline SSL processing of an application running on a server/host to an embedded networking device such as a Network Interface Card (NIC), which serves as a hardware accelerator for all applications running on the server that need to have a secure connection with a remote client device over a network. By utilizing a plurality of its software and hardware features, the embedded networking device is configured to process all SSL operations of the secure connection inline, i.e., the SSL operations are performed as packets are transferred between the host and the client over the network, rather than having the SSL operations offloaded to the NIC, which then returns the packets to the host (or the remote client device) before they can be transmitted to the remote client device (or to the host).

Systems and methods for offloading inline SSL processing to an embedded networking device

A new approach is proposed that contemplates systems and methods to support hardware-based Quality of Service (QoS) operations, which offloads metering functionalities under OpenFlow protocol to a programmable hardware unit/block/component. The hardware unit supports several hardware implemented ports and each port supports multiple configurable queues for the packet flows through a network switch/chip/system. Specifically, the hardware unit includes a plurality of descriptor queues (DQs) configured to accept requests to send a plurality of packets from one or more CPU cores, and a plurality of condition and schedule modules configured to meter, schedule, and condition the packets through a hierarchy of scheduling queues under one or more metering constraints. The hardware unit is programmable to configure the byte-based and/or packet-based rate-limit for each of the packet flows with a calculated adjustment on allowed variations without requiring complex QoS algorithms to maintain the rate-limits of the flows.

Systems and methods for hardware accelerated metering for openflow protocol

A new approach is proposed that contemplates systems and methods to support hot plugging and/or unplugging one or more of remote storage devices virtualized as extensible/flexible storages and NVMe namespace(s) via an NVMe controller during operation. First, the NVMe controller virtualizes and presents a set of remote storage devices to one or more VMs running on a host attached to the NVMe controller as logical volumes in the NVMe namespace(s) so that each of the VMs running on the host can access these remote storage devices to perform read/write operations as if they were local storage devices. When the one or more remote storage devices are added to or removed from the set of remote storage devices based on storage space needs of the VMs, the NVMe controller updates the logical volumes in the NVMe namespace(s) accordingly and enables these remote storage devices to be hot plugged or unplugged from the plurality of remote storage devices at runtime without requiring shutting down and restarting any of the VMs, the host, and/or the NVMe controller. The VMs may then perform read/write operations on the NVMe namespace(s) updated to reflect the changes in the configuration of the set of remote storage devices dynamically without any interruption.

Systems and methods for supporting hot plugging of remote storage devices accessed over a network via NVME controller

A new approach is proposed to support a virtual network switch, which is a software implementation of a network switch utilizing hardware to accelerate implementation of timers of the virtual network switch under OpenFlow protocol. The approach utilizes a plurality of hardware-implemented timer blocks/rings, wherein each of the rings covers a specified time period and has a plurality of timer buckets each corresponding to an interval of expiration time of timers. When a new flow table entry is programmed at an OpenFlow agent of the virtual network switch, its associated timer entries are created and inserted into the corresponding timer bucket based on the expiration time of the timers. During operation, hardware of the virtual network switch traverses the timer rings for the timer bucket which time has expired, identifies timer entries in the expired timer bucket, interrupts CPU or provides a notification to the agent with necessary contextual information.

Systems and methods for hardware accelerated timer implementation for openflow protocol

A new approach is proposed that contemplates systems and methods to support elastic (extensible/flexible) storage access in real time by mapping a plurality of remote storage devices that are accessible over a network fabric as logical namespace(s) via a logical storage controller using a multitude of access mechanisms and storage network protocols. The logical storage controller exports and presents the remote storage devices to one or more VMs running on a host of the logical storage controller as the logical namespace(s), wherein these remote storage devices appear virtually as one or more logical volumes of a collection of logical blocks in the logical namespace(s) to the VMs. As a result, each of the VMs running on the host can access these remote storage devices to perform read/write operations as if they were local storage devices via the logical namespace(s).

Systems and methods for enabling access to extensible remote storage over a network as local storage via a logical storage controller

A new approach is proposed that contemplates systems and methods to virtualize a physical NVMe controller associated with a computing device or host so that every virtual machine running on the host can have its own dedicated virtual NVMe controller. First, a plurality of virtual NVMe controllers are created on a single physical NVMe controller, which is associated with one or more storage devices. Once created, the plurality of virtual NVMe controllers are provided to VMs running on the host in place of the single physical NVMe controller attached to the host, and each of the virtual NVMe controllers organizes the storage units to be accessed by its corresponding VM as a logical volume. As a result, each of the VMs running on the host has its own namespace(s) and can access its storage devices directly through its own virtual NVMe controller.

Systems and methods for NVMe controller virtualization to support multiple virtual machines running on a host

A new approach is proposed virtual machines (VMs) accessing remote storage devices over a network via non-volatile memory express (NVMe) controllers to migrate live from a current host to a destination host. A first virtual NVMe controller running on a first physical NVMe controller enables a first VM running on the current host to perform storage operations to logical volumes mapped to the remote storage devices over the network as if they were local storage volumes. During VM migration, the current host puts the first virtual NVMe controller into quiesce state and saves an image of its states. A second virtual NVMe controller is created on a second physical NVMe controller using the saved image, which is configured to serve a second VM on the destination host. The second virtual NVMe controller resumes the storage operations to the remote storage devices without being interrupted by the VM migration.

Systems and methods for supporting migration of virtual machines accessing remote storage devices over network via NVMe controllers

A new approach is proposed that contemplates systems and methods to support extensible/flexible storage access in real time by virtualizing a plurality of remote storage devices as NVMe namespace(s) via an NVMe controller using a storage network protocol. The NVMe controller exports and presents the remote storage devices to one or more VMs running on a host attached to the NVMe controller as the NVMe namespace(s), wherein these remote storage devices appear virtually as one or more logical volumes of a collection of logical blocks in the NVMe namespace(s) to the VMs. As a result, each of the VMs running on the host can access these remote storage devices to perform read/write operations as if they were local storage devices via the NVMe namespace(s).

Growing community of inventors

Sunnyvale, CA, United States of America

Manojkumar Panicker