Offloading packet processing for networking device virtualization

1. At a computer system including one or more processors and system memory, the computer system also including a physical network interface card (NIC) and executing a host partition, a method for processing network packets for a virtual machine executing at the computer system, the method comprising:

an act of the physical NIC maintaining one or more flow tables for the virtual machine, the one or more flow tables being based on one or more rule sets for the virtual machine that are maintained at the host partition;

an act of the physical NIC receiving a network packet associated with the virtual machine; and

an act of processing the network packet for the virtual machine, including:

an act of the physical NIC comparing the network packet with the one or more flow tables, and

when the network packet matches with a flow in the one or more flow tables, an act of the physical NIC performing an action on the network packet based on the matching flow, or

when the network packet does not match with a flow in the one or more flow tables, an act of the physical NIC passing the network packet to the host partition for processing against the one or more rule sets, including the physical NIC passing the network packet to the host partition through the virtual machine.

2. The method as recited in claim 1 , wherein the one or more rule sets include one or more of an incoming rule set or an outgoing rule set for the virtual machine.

3. The method as recited in claim 1 , wherein the one or more flow tables include one or more of an incoming flow table or an outgoing flow table for the virtual machine.

4. The method as recited in claim 1 , further comprising, when the network packet does not match with a flow in the one or more flow tables, an act of the host partition comparing the network packet with the one or more rule sets.

5. The method as recited in claim 4 , wherein when the network packet matches with a rule in the one or more rule sets, an act of the host partition performing an action on the network packet based on the matching rule.

6. The method as recited in claim 5 , wherein when the network packet matches with a rule in the one or more rule sets, an act of the host partition creating one or more flows at the physical NIC in the one or more flow tables.

7. The method as recited in claim 1 , further comprising an act of the host partition maintaining one or more flow tables for the virtual machine, and wherein the one or more flow tables maintained at the physical NIC comprise a subset of the one or more flow tables maintained at the host partition.

8. The method as recited in claim 1 , further comprising:

an act of a virtual NIC driver at the virtual machine storing at least a portion of an outgoing flow table in an outgoing flow list; and

an act of the virtual NIC driver comparing the network packet with the outgoing flow list prior to sending the network packet to the physical NIC.

9. The method as recited in claim 1 , wherein the computer system executes a plurality of virtual machines, and wherein act of the host partition maintaining one or more rule sets for the virtual machine comprises an act of the host partition maintaining different rule sets for each of the plurality of virtual machines.

10. The method as recited in claim 1 , wherein the computer system executes a plurality of virtual machines, and wherein the act of the physical NIC maintaining one or more flow tables for the virtual machine comprises an act of the physical NIC maintaining different flow tables for each of the plurality of virtual machines.

11. The method as recited in claim 1 , wherein the host partition maintains a plurality of layers of rule sets, each layer including a corresponding incoming rule set and a corresponding outgoing rule set, and wherein the host partition processes network packets by passing each network packet through each layer while, at each layer, matching each network packet against one of the corresponding incoming rule set or the corresponding outgoing rule set.

12. A computer program product comprising one or more hardware storage devices having stored thereon computer executable instructions that, when executed by one or more processors of a computer system, cause the computer system to implement a method for processing network packets for a virtual machine executing at the computer system, the method comprising:

an act of a virtual switch maintaining one or more rule sets for a virtual machine, including maintaining a plurality of layers of rule sets, each layer including a corresponding incoming rule set and a corresponding outgoing rule set;

an act of the virtual switch maintaining one or more flow table for the virtual machine;

an act of the virtual switch offloading at least a portion of the one or more flow tables to the physical NIC; and

an act of the virtual switch processing a network packet for the virtual machine, including:

the virtual switch receiving the network packet from one of the virtual machine or the physical NIC;

the virtual switch matching the network packet with a rule in the one or more rule sets, including the virtual switch passing each network packet through each layer of the plurality of layers of rule sets while, at each layer, the virtual switch matching each network packet against one of the corresponding incoming rule set or the corresponding outgoing rule set; and

based on matching the network packet with the rule:

the virtual switch creating a flow in the one or more flow tables; and

the virtual switch offloading the flow to the physical NIC.

13. The computer program product as recited in claim 12 , wherein the act of the virtual switch processing a network packet for the virtual machine also includes:

the virtual switch performing at least one action on the network packet based on the rule.

14. The computer program product as recited in claim 13 , wherein the at least one action comprises one or more of a packet inspection or a packet manipulation operation.

15. A computer system, comprising:

one or more processors;

system memory;

a physical network interface card (NIC); and

one or more computer storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, execute a virtual switch, the virtual switch being configured to:

execute within a host partition at the computer system;

maintain an incoming rule set and an outgoing rule set for a virtual machine;

maintain an incoming flow table and an outgoing flow table for the virtual machine;

offload at least a portion of one or more of the incoming flow table or the outgoing table to a virtual bridge at the physical NIC; and

process a network packet for the virtual machine, including:

receiving the network packet from one or more of the virtual machine or the physical NIC;

matching the network packet with a rule in one of the incoming rule set or the outgoing rule set, including the virtual switch passing each network packet through each layer of the plurality of layers of rule sets while, at each layer, the virtual switch matching each network packet against one of the corresponding incoming rule set or the corresponding outgoing rule set; and

based on matching the network packet with the rule:

creating a flow in one or more of the incoming flow table or the outgoing flow table at the virtual switch; and

offloading the flow to one or more of the incoming flow table or the outgoing table at the virtual bridge of the physical NIC.

16. The computer system as recited in claim 15 , wherein the physical NIC comprises a Peripheral Component Interconnect Express (PCIe) NIC.

17. The computer system as recited in claim 16 , wherein the physical NIC presents a Single Root I/O Virtualization (SRIOV) function to the virtual machine.

18. The computer system as recited in claim 15 , wherein the virtual switch passing each network packet through each layer of the plurality of layers of rule sets comprises passing each network packet through each layer of the plurality of layers in a first direction for packet that are being sent by the virtual machine, and passing each network packet through each layer of the plurality of layers in a second opposite direction for packets that are being received by the virtual machine.

19. The computer system as recited in claim 15 , wherein while, at each layer, the virtual switch matching each network packet against one of the corresponding incoming rule set or the corresponding outgoing rule set comprises performing an action on each packet prior to forwarding the packet to a next layer.

20. The computer system as recited in claim 19 , further comprising refraining from forwarding the packet to the next layer when the action comprises a block action.