Network interface controller with integrated network flow processing
View Patent ↗A system includes network interface controller (NIC) and a host processor. The host processor may run a hypervisor or OS which may manage virtual network activity for virtual machines (VMs) and/or applications. The NIC may provide a physical function to the hypervisor to support network activity by the VMs and/or applications. Some VMs and/or applications on the network may bypass the hypervisor and access virtual functions from the NIC. The NIC may execute a configurable flow analyzer (CFA), which may perform flow processing operations on the network traffic. The CFA may access flow configuration and management parameters maintained by the hypervisor to control implementation of the flow processing operations. Performing the flow processing operations on the traffic for the VMs and/or applications bypassing the hypervisor or OS may extend management by the hypervisor or OS to these VMs and/or applications.
1. A system, comprising:
a host system having a processor and a memory, the host system configured to instantiate a virtual switch, a first virtual machine and a second virtual machine; and
network interface circuitry in data communication with the host system, the network interface circuitry having a network port and configured to perform flow processing operations and to switch traffic between a physical function interface and a virtual function interface in accordance with a flow identifier (ID) for the traffic by:
providing, to the virtual switch of the host system, access to the network port through the physical function interface of the network interface circuitry;
providing, to the first virtual machine of the host system, access to the network port through the virtual function interface to bypass the virtual switch, wherein the first virtual machine is configured to bypass the virtual switch to access the network port;
generating a flow key from data within a header of a packet associated with the first virtual machine;
performing a lookup process using the flow key to determine the flow ID for the packet;
receiving flow management parameters for the network port from the virtual switch via an offload path that is parallel to the physical function interface between the network interface circuitry and the host system, wherein the flow management parameters are associated with the flow ID and the flow management parameters indicate a flow action to be performed; and
applying the flow management parameters to the packet, by performing the flow action prior to transmission via the network port, to extend a management domain of the virtual switch to the virtual function interface, wherein
the lookup process is performed using an exact match lookup table in a case that the flow key is of a first format,
the lookup process is performed using a wild card lookup table in a case that the flow key is of a second format different from the first format,
the second virtual machine is configured to access the network port through the virtual switch without having a direct connection to the network interface circuitry, and
the network interface circuitry is further configured to apply the flow management parameters to traffic associated with the second virtual machine received through the network port.
2. The system of claim 1 , wherein the virtual function interface bypasses a hypervisor configured to manage the virtual switch.
3. The system of claim 1 , wherein the flow action comprises incrementing a counter, mirroring a flow, metering a flow rate, sampling a flow, aging a flow, changing a virtual local area network tag, encapsulation, decapsulation, performing a logic check, network address translation, dropping the packet, or any combination thereof.
4. The system of claim 1 , wherein the flow management parameters are for incoming network traffic, outgoing network traffic, or any combination thereof.
5. The system of claim 1 , wherein the network interface circuitry is configured to receive the flow management parameters from a kernel space of a hypervisor of the virtual switch via the offload path.
6. A method, implemented by network interface circuitry that has a network port, the network interface circuitry being in data communication with a host system that is configured to instantiate a virtual switch, a first virtual machine and a second virtual machine, the method comprising:
performing flow processing operations, and switching traffic between a physical function interface and a virtual function interface in accordance with a flow identifier (ID) for the traffic by:
providing, to the virtual switch of the host system, access to the network port through the physical function interface of the network interface circuitry;
providing, to the first virtual machine of the host system, access to the network port through the virtual function interface to bypass the virtual switch, wherein the first virtual machine is configured to bypass the virtual switch to access the network port;
generating a flow key from data within a header of a packet associated with the first virtual machine;
performing a lookup process using the flow key to determine the flow ID for the packet;
receiving flow management parameters for the network port from the virtual switch via an offload path that is parallel to the physical function interface between the network interface circuitry and the host system, wherein the flow management parameters are associated with the flow ID and the flow management parameters indicate a flow action to be performed; and
applying the flow management parameters to the packet, by performing the flow action prior to transmission via the network port, to extend a management domain of the virtual switch to the virtual function interface, wherein
the lookup process is performed using an exact match lookup table in a case that the flow key is of a first format,
the lookup process is performed using a wild card lookup table in a case that the flow key is of a second format different from the first format,
the second virtual machine is configured to access the network port through the virtual switch without having a direct connection to the network interface circuitry, and
the applying further includes applying the flow management parameters to traffic associated with the second virtual machine received through the network port.
7. The method of claim 6 , wherein the flow processing function comprises a flow processing function for the virtual function interface and the virtual function interface comprises a child function of the physical function.
8. The method of claim 6 , wherein the flow processing function comprises incrementing a counter, mirroring a flow, metering a flow rate, sampling a flow, aging a flow, changing a virtual local area network tag, encapsulation, decapsulation, performing a transistor-transistor logic check, network address translation, dropping a packet, or any combination thereof.
9. The method of claim 6 , wherein receiving the flow management parameters comprises receiving the flow management parameters from a kernel space of a hypervisor of the virtual switch via the offload path.
10. A product, comprising:
a non-transitory machine-readable medium; and
instructions stored on the non-transitory machine-readable medium, the instructions configured to, when executed by network interface circuitry that has a network port, the network interface circuitry being in data communication with a host system that is configured to instantiate a virtual switch, a first virtual machine and a second virtual machine, cause the network interface circuitry to perform a method comprising:
performing flow processing operations, and switching traffic between a physical function interface and a virtual function interface in accordance with a flow identifier (ID) for the traffic by:
providing, to the virtual switch of the host system, access to the network port through the physical function interface of the network interface circuitry;
providing, to the first virtual machine of the host system, access to the network port through the virtual function interface to bypass the virtual switch, wherein the first virtual machine is configured to bypass the virtual switch to access the network port;
generating a flow key from data within a header of a packet associated with the first virtual machine;
performing a lookup process using the flow key to determine the flow ID for the packet;
receiving flow management parameters for the network port from the virtual switch via an offload path that is parallel to the physical function interface between the network interface circuitry and the host system, wherein the flow management parameters are associated with the flow ID and the flow management parameters indicate a flow action to be performed; and
applying the flow management parameters to the packet, by performing the flow action prior to transmission via the network port, to extend a management domain of the virtual switch to the virtual function interface, wherein
the lookup process is performed using an exact match lookup table in a case that the flow key is of a first format,
the lookup process is performed using a wild card lookup table in a case that the flow key is of a second format different from the first format,
the second virtual machine is configured to access the network port through the virtual switch without having a direct connection to the network interface circuitry, and
the applying further includes applying the flow management parameters to traffic associated with the second virtual machine received through the network port.
11. The product of claim 10 , wherein receiving the flow management parameters comprises receiving the flow management parameters from a kernel space of a hypervisor of the virtual switch via the offload path.