# US 10,454,824 B2 · Generic communication channel for information exchange between a hypervisor and a virtual machine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,824 B2 - Document ID: US10454824B2 - Status: Granted - Kind: B2 - Application number: 15/909,889 - Filed: 2018-03-01 - Published: 2019-09-05 - Granted: 2019-10-22 - Earliest claimed: 2018-03-01 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Caixia Jiang; Jianjun Shen; Aditi Ghag; Danting Liu; Hongshun Chang; Donghai Han; Vladimir Cherepanov - Web page: https://patentgrep.com/patent/US10454824B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/4645: {Details on frame tagging (routing of packets H04L45/00; support for virtual LAN H04L49/354)} - H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's} - H04L 49/70: {Virtual switches} - H04L 61/5007: Internet protocol [IP] addresses - H04L 61/5038: for local use, e.g. in LAN or USB networks, or in a controller area network [CAN] - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 61/2514: between local and global IP addresses - H04L 61/2525: {Translation at a client} - H04L 2012/445: {with switching in a hub, e.g. ETHERNET switch} - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Certain embodiments described herein are generally directed to configuring a generic channel for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on a host machine. In some embodiments, the generic channel represents a network or communication path enabled by a logical switch that connects a HyperBus running on the hypervisor and a node agent running on the virtual machine. In some embodiments, network traffic handled by the generic channel is isolated from incoming and outgoing network traffic between the virtual machine and one or more other virtual machines or hosts. ## Claims ### Claim 1 A method for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on a host machine, comprising: receiving, at a first daemon running on the hypervisor, information from a network control plane, wherein the information is destined for a second daemon running inside the virtual machine; generating, at the first daemon, a packet having a payload including at least a portion of the information and a header including a source internet protocol (IP) address of the first daemon, a source media access control (MAC) address of the first daemon, a first destination IP address associated with the second daemon, and a destination MAC address of the second daemon; storing a first identifier in metadata associated with the packet; receiving, at a first port of a first virtual switch implemented by the hypervisor, the packet from the first daemon, the first daemon being coupled to the first port; determining, at the first virtual switch, to forward the packet to a second port of the first virtual switch based on the first identifier, the destination MAC address, and the first destination IP address, wherein the second port is configured to pass packets associated with the first identifier; tagging, at the first virtual switch, the packet with a second identifier based on a mapping of the first identifier to the second identifier; transmitting the packet, at the second port of the first virtual switch, to a virtual network interface card (VNIC) of the virtual machine, wherein the VNIC is coupled to the second port; passing, at the VNIC, the packet to a second virtual switch implemented by the virtual machine; determining, at the second virtual switch, to forward the packet to a port on the second virtual switch based on the second identifier, the destination MAC address, and a second destination IP address, wherein the port is configured to pass packets associated with the second identifier, wherein the second daemon is coupled to the port; and receiving the packet at the second daemon over the port. ### Claim 2 (depends on 1) The method of claim 1, wherein the first identifier comprises a virtual extensible local area network ID (VXLAN ID), wherein the second identifier comprises a virtual local area network ID (VLAN ID) associated with a VLAN for connecting the first daemon and the second daemon. ### Claim 3 (depends on 1) The method of claim 1, wherein the information comprises network interface configuration information of a container, the method further comprising: collecting, at a node agent, the information from the second daemon; and configuring a network interface of the container using the information. ### Claim 4 (depends on 3) The method of claim 3, wherein after the configuring, traffic associated with the container is communicated by the first virtual switch to the VNIC of the virtual machine using a port different than the second port. ### Claim 5 (depends on 1) The method of claim 1, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein each copy of the second daemon is configured with the second destination IP address, the second destination IP address being different than the first destination IP address; the method further comprising: performing network address translation, at the second port of the first virtual switch, to replace the first destination IP address of the second daemon with the second destination IP address of the second daemon, prior to the transmitting. ### Claim 6 (depends on 1) The method of claim 1, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein the plurality of virtual machines are in an isolated private local area network (PVLAN) port group, and wherein the first daemon is in a promiscuous PVLAN port group. ### Claim 7 (depends on 1) The method of claim 1, wherein the first daemon generates and allocates the first destination IP address associated with the second daemon. ### Claim 8 (depends on 1) The method of claim 1, wherein the first daemon uses a network stack in the hypervisor that is different than a network stack in the hypervisor that handles networking for traffic communicated between the virtual machine and one or more other virtual machines running on the hypervisor and traffic communicated between the virtual machine and one or more other hosts. ### Claim 9 (depends on 1) The method of claim 1, wherein the first virtual switch is configured to drop packets upon determining that a rate at which the virtual machine is sending packets to the first daemon exceeds a threshold. ### Claim 10 (depends on 1) The method of claim 1, wherein the second daemon is prevented from initiating a connection with the first daemon. ### Claim 11 (depends on 1) The method of claim 1, wherein the first destination IP address is the same as the second destination IP address. ### Claim 12 A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on the computer system, the method comprising: receiving, at a first daemon running on the hypervisor, information from a network control plane, wherein the information is destined for a second daemon running inside the virtual machine; generating, at the first daemon, a packet having a payload including at least a portion of the information and a header including a source internet protocol (IP) address of the first daemon, a source media access control (MAC) address of the first daemon, a first destination IP address associated with the second daemon, and a destination MAC address of the second daemon; storing a first identifier in metadata associated with the packet; receiving, at a first port of a first virtual switch implemented by the hypervisor, the packet from the first daemon, the first daemon being coupled to the first port; determining, at the first virtual switch, to forward the packet to a second port of the first virtual switch based on the first identifier, the destination MAC address, and the first destination IP address, wherein the second port is configured to pass packets associated with the first identifier; tagging, at the first virtual switch, the packet with a second identifier based on a mapping of the first identifier to the second identifier; transmitting the packet, at the second port of the first virtual switch, to a virtual network interface card (VNIC) of the virtual machine, wherein the VNIC is coupled to the second port; passing, at the VNIC, the packet to a second virtual switch implemented by the virtual machine; determining, at the second virtual switch, to forward the packet to a port on the second virtual switch based on the second identifier, the destination MAC address, and a second destination IP address, wherein the port is configured to pass packets associated with the second identifier, wherein the second daemon is coupled to the port; and receiving the packet at the second daemon over the port. ### Claim 13 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the first identifier comprises a virtual extensible local area network ID (VXLAN ID), wherein the second identifier comprises a virtual local area network ID (VLAN ID) associated with a VLAN for connecting the first daemon and the second daemon. ### Claim 14 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the information comprises network interface configuration information of a container, the method further comprising: collecting, at a node agent, the information from the second daemon; and configuring a network interface of the container using the information, wherein after the configuring, traffic associated with the container is communicated by the first virtual switch to the VNIC of the virtual machine using a port different than the second port. ### Claim 15 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein each copy of the second daemon is configured with the second destination IP address, the second destination IP address being different than the first destination IP address; the method further comprising: performing network address translation, at the second port of the first virtual switch, to replace the first destination IP address of the second daemon with the second destination IP address of the second daemon, prior to the transmitting. ### Claim 16 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the first daemon generates and allocates the first destination IP address associated with the second daemon. ### Claim 17 A computer system, wherein system software for the computer system is programmed to execute a method for exchanging information between a hypervisor and a virtual machine run by the hypervisor that resides on the computer system, the method comprising: receiving, at a first daemon running on the hypervisor, information from a network control plane, wherein the information is destined for a second daemon running inside the virtual machine; generating, at the first daemon, a packet having a payload including at least a portion of the information and a header including a source internet protocol (IP) address of the first daemon, a source media access control (MAC) address of the first daemon, a first destination IP address associated with the second daemon, and a destination MAC address of the second daemon; storing a first identifier in metadata associated with the packet; receiving, at a first port of a first virtual switch implemented by the hypervisor, the packet from the first daemon, the first daemon being coupled to the first port; determining, at the first virtual switch, to forward the packet to a second port of the first virtual switch based on the first identifier, the destination MAC address, and the first destination IP address, wherein the second port is configured to pass packets associated with the first identifier; tagging, at the first virtual switch, the packet with a second identifier based on a mapping of the first identifier to the second identifier; transmitting the packet, at the second port of the first virtual switch, to a virtual network interface card (VNIC) of the virtual machine, wherein the VNIC is coupled to the second port; passing, at the VNIC, the packet to a second virtual switch implemented by the virtual machine; determining, at the second virtual switch, to forward the packet to a port on the second virtual switch based on the second identifier, the destination MAC address, and a second destination IP address, wherein the port is configured to pass packets associated with the second identifier, wherein the second daemon is coupled to the port; and receiving the packet at the second daemon over the port. ### Claim 18 (depends on 17) The computer system of claim 17, wherein the first identifier comprises a virtual extensible local area network ID (VXLAN ID), wherein the second identifier comprises a virtual local area network ID (VLAN ID) associated with a VLAN for connecting the first daemon and the second daemon. ### Claim 19 (depends on 17) The computer system of claim 17, wherein the information comprises network interface configuration information of a container, the method further comprising: collecting, at a node agent, the information from the second daemon; and configuring a network interface of the container using the information, wherein after the configuring, traffic associated with the container is communicated by the first virtual switch to the VNIC of the virtual machine using a port different than the second port. ### Claim 20 (depends on 17) The computer system of claim 17, wherein the hypervisor runs a plurality of virtual machines including the virtual machine, each of the plurality of virtual machines running a copy of the second daemon, wherein each copy of the second daemon is configured with the second destination IP address, the second destination IP address being different than the first destination IP address; the method further comprising: performing network address translation, at the second port of the first virtual switch, to replace the first destination IP address of the second daemon with the second destination IP address of the second daemon, prior to the transmitting. ### Claim 21 (depends on 17) The computer system of claim 17, wherein the first daemon generates and allocates the first destination IP address associated with the second daemon.