Offloading packet processing programs from virtual machines to a hypervisor and efficiently executing the offloaded packet processing programs
In one set of embodiments, a hypervisor of a host system can receive a packet processing program from a virtual network interface controller (NIC) driver of a virtual machine (VM) running on the hypervisor. The hypervisor can then attach the packet processing program to a first execution point in a physical NIC driver of the hypervisor and to a second execution point in a virtual NIC backend of the hypervisor, where the virtual NIC backend corresponds to a virtual NIC of the VM that originated the packet processing program.
1. A host system comprising:
a processor;
a storage medium comprising instructions executable by the processor; and
a network interface card (NIC), the NIC being configured to receive an ingress packet and extract a destination address from the ingress packet;
wherein the processor is configured to execute the instructions to:
instantiate a hypervisor running a virtual machine (VM), the VM comprising a virtual NIC driver, the hypervisor comprising a physical NIC driver associated with the NIC;
configure a packet processing program from the virtual NIC driver;
attach the packet processing program to a first execution point in the physical NIC driver;
attach the packet processing program to a second execution point in a virtual NIC backend of the hypervisor; and
select between the first execution point and the second execution point;
wherein the physical NIC driver is configured to:
determine whether the destination address is associated with the packet processing program or any other packet processing program attached to the first execution point, and
execute the packet processing program against the ingress network packet and to allocate hypervisor networking stack metadata for the ingress network packet.
2. The host system of claim 1 , wherein the virtual NIC backend corresponds to the virtual NIC driver originated from the packet processing program.
3. The host system of claim 1 , wherein the packet processing program is expressed in a bytecode.
4. The host system of claim 1 , wherein the packet processing program is verified and compiled by the hypervisor prior to being attached to the first and second execution points.
5. The host system of claim 1 , wherein the virtual NIC backend is configured to receive a network packet from a networking stack of the hypervisor, the network packet including hypervisor networking stack metadata, and to determine whether the hypervisor networking stack metadata includes an indication that the packet processing program was previously executed against the network packet at the first execution point.
6. The host system of claim 5 , wherein if the hypervisor networking stack metadata does not include the indication, the virtual NIC backend is configured to execute the packet processing program against the network packet.
7. A method comprising:
instantiating a hypervisor running a virtual machine (VM), the VM comprising a virtual network interface card (NIC) driver, the hypervisor comprising a physical NIC driver associated with the NIC;
configuring a packet processing program from the virtual NIC driver;
receiving an ingress packet by a physical;
extracting a destination address from the ingress packet;
attaching the packet processing program to a first execution point in the physical NIC driver;
attaching the packet processing program to a second execution point in a virtual NIC backend of the hypervisor; and
selecting between the first execution point and the second execution point based at least on the destination address
wherein the physical NIC driver is configured to:
determine whether the destination address is associated with the packet processing program or any other packet processing program attached to the first execution point, and
execute the packet processing program against the ingress network packet and to allocate hypervisor networking stack metadata for the ingress network packet.
8. The method of claim 7 , further comprising executing the packet processing program against the ingress network packet by the physical NIC driver.
9. The method of claim 8 , further comprising allocating hypervisor networking stack metadata for the ingress network packet.
10. The method of claim 9 , further comprising including an indication in the hypervisor networking stack metadata that the packet processing program has been executed against the ingress network packet.
11. The method of claim 7 , further comprising determining, by the physical NIC driver, whether the ingress network packet was received by a physical NIC in a hardware RX queue that is mapped to a packet processing program-attached virtual NIC backend, the hardware RX queue being associated with an RX filter that causes the physical NIC to automatically place all ingress traffic destined for the packet processing program-attached virtual NIC backend into the hardware RX queue.
12. A method comprising:
instantiating a hypervisor running a virtual machine (VM), the VM comprising a virtual network interface card (NIC) driver, the hypervisor comprising a physical NIC driver associated with the NIC;
configuring a packet processing program from the virtual NIC driver;
receiving a network packet from a networking stack of the hypervisor, the network packet including hypervisor networking stack metadata;
attaching the packet processing program to a first execution point in the physical NIC driver;
attaching the packet processing program to a second execution point in a virtual NIC backend of the hypervisor; and
selecting between the first execution point and the second execution point based at least on the hypervisor networking stack metadata;
wherein the physical NIC driver is configured to:
determine whether the destination address is associated with the packet processing program or any other packet processing program attached to the first execution point, and
execute the packet processing program against the ingress network packet and to allocate hypervisor networking stack metadata for the ingress network packet.
13. The method of claim 12 , further comprising determining whether the hypervisor networking stack metadata includes an indication that the packet processing program was previously executed against the network packet at the first execution point.
14. The method of claim 13 , further comprising if the hypervisor networking stack metadata does not include the indication, executing, by the virtual NIC backend, the packet processing program against the network packet.
15. The method of claim 12 , wherein the first execution point is located in a receive path (RX) of the physical NIC driver that receives and handles ingress network packets.
16. The method of claim 12 , wherein the packet processing program is expressed in a bytecode.
17. The method of claim 12 , wherein the packet processing program is verified and compiled by the hypervisor prior to being attached to the first and second execution points.
18. The method of claim 12 , wherein the hypervisor is configured to determine an optimal execution point for the packet processing program between the physical NIC driver and the virtual NIC backend.