Supporting ephemeral ports in a virtualized environment

Methods, apparatuses, articles, and systems for receiving a request for an allocation of one or more ephemeral ports from a pool of ephemeral ports associated with a physical device, for a virtual machine of the physical device, are described herein. In various embodiments, an ephemeral port manager of the physical device is adapted to allocate up to the one or more ephemeral ports requested from the pool of ephemeral ports, if up to the one or more ephemeral ports are available for allocation from the pool of ephemeral ports. In some embodiments, the ephemeral port manager is further adapted to mark the allocated one or more ephemeral ports as unavailable to meet an ephemeral port allocation request of another virtual machine of the physical device.

TECHNICAL FIELD

Embodiments relate to the fields of data processing and data communication, in particular, to methods and apparatuses for supporting ephemeral port allocation to virtual machines on a common platform or physical device.

BACKGROUND

Continuous advancements in virtualization and multi-processor core technology have given rise to the possibility of networking virtual machines on the same platform or physical device. The plurality of virtual machines may appear to each other and to other computing devices as distinct computing systems, each having its own Internet Protocol (IP) address. The virtual machines of a computing device may also share the IP address of the computing device, with each virtual machine using the same, real IP address. Sharing the IP address between multiple virtual machines, however, often requires the plurality of virtual machines to share a pool of ephemeral ports associated with the IP address. Ephemeral ports are assigned on an as needed basis to applications communicating across a network with another system or application. To receive return traffic, an application is assigned an ephemeral port. Multiple virtual machines, not aware of the other virtual machines sharing the computing device, may both allocate the same ephemeral port or ports of the computing device. Further, since the ephemeral ports are associated with the computing device and not any particular virtual machine, routing software of the computing device receiving the return traffic may not know to which virtual machine to route the traffic.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

Illustrative embodiments of the present invention include, but are not limited to, methods and apparatuses for receiving a request for an allocation of one or more ephemeral ports from a pool of ephemeral ports associated with a physical device, for a virtual machine of the physical device. In various embodiments, an ephemeral port manager of the physical device is adapted to allocate up to the one or more ephemeral ports requested from the pool of ephemeral ports, if up to the one or more ephemeral ports are available for allocation from the pool of ephemeral ports. In some embodiments, the ephemeral port manager is further adapted to mark the allocated one or more ephemeral ports as unavailable to meet an ephemeral port allocation request of another virtual machine of the physical device.

FIG. 1illustrates an overview of various embodiments of the present invention, supporting ephemeral ports in a virtualized environment of a physical device. As illustrated, platform or physical device102comprises a plurality of virtual machines104and an ephemeral port manager118, coupled to each other as shown. As will be described in more detail below, the ephemeral port manager118, incorporated with the teachings of embodiments of the present invention, is adapted to be able to receive requests from one or more of the virtual machines104for allocations of one or more ephemeral ports from the pool of ephemeral ports associated with the physical device102, to allocate ephemeral ports to the requesting virtual machine104or to all virtual machines104, and to mark the allocated ephemeral ports as unavailable to meet further allocation requests. While embodiments of the invention are described as including a plurality of virtual machines104, the embodiments of the invention may be practiced with one virtual machine or a plurality of virtual machines.

As illustrated, the physical device102includes a plurality of virtual machines104, a routing module114capable of routing packets to and from the virtual machines104, the routing module114having a mapping116of ephemeral ports to the virtual machines104, an ephemeral port manager118capable of receiving requests for allocations of ephemeral ports, allocating the ephemeral ports to the virtual machines104, and marking the allocated ports as unavailable after allocation, and network hardware120capable of receiving packets from external systems, sending packets to those systems, and sending packet to and receiving packets from the routing module114. Additionally, each of the virtual machines104includes at least one application106, a network/IP stack108to facilitate network communication for the at least one application106and other applications, a virtual machine Network Interface Controller (NIC)110to send packets to and receive packets from the routing module114, and an ephemeral port configurator112capable of requesting an allocation of ephemeral ports from ephemeral port manager118, receiving notification of the allocation, and communicating the allocation to the network/IP stack108. The various elements are coupled to each other as shown. In various embodiments, network/IP stack108and NIC110, individually or collectively, may abstract and shield all the networking hardware details from application106.

In various embodiments, physical device102may be any single- or multi-processor or processor core central processing unit (CPU) computing system known in the art. Physical device102may be a personal computer (PC), a workstation, a server, a router, a mainframe, a personal digital assistant (PDA), an entertainment center, a set-top box, or a mobile device. The physical device102may be capable of operating a plurality of operating systems of a plurality of virtual machines104using virtualization technologies. If physical device102is a multi-processor or multi-processor core system, each virtual machine104of physical device102may, for example, be coupled to a processor or processor core dedicated to that virtual machine104. In a single processor or single processor core physical device102, the plurality of virtual machines104may share the single processor or processor core. An exemplary single-/multi-processor or processor core physical device102is illustrated byFIG. 3, and is described in greater detail below. Hereinafter, including in the claims, processor and processor core shall be used interchangeably, with each term including the other. Physical device102may also be coupled to a networking fabric (not shown), described below, and may be identified by an IP address to other devices connected through the networking fabric.

As shown and alluded to earlier, physical device102may include a plurality of virtual machines104. The virtual machines104, except for the teachings of the embodiments of the present invention, may be any sort of virtual machines. Each virtual machine104may be a self-contained operating environment that behaves as if it is a separate computer system. To an outside system coupled to physical device102through a networking fabric, however, the virtual machines104may appear to be the same computing device, as the plurality of virtual machines104share the IP address of the physical device102. The virtual machines104may also each have an operating system capable of managing multiple processes, such as application106of each virtual machine104, and may each have a protected memory space that operationally belongs exclusively to that virtual machine104, and one or more shared memory spaces, the shared memory spaces accessible for storing and retrieving data by more than one of the virtual machines104. Suitable virtual machines and virtualization technologies include but are not limited to those available from Microsoft Corporation of Redmond, Wash., and XenSource of Cambridge, UK.

In some embodiments, each of the virtual machines104may include at least one application106, a network/IP protocol stack108, a virtual machine network interface controller (NIC)110, and an ephemeral port configurator112. The at least one application106may be any process or sub-process of a virtual machine104. The application106may operate and communicate with the operating system and network/IP stack108of the virtual machine104in the same way that it might operate with an operating system and network/IP stack of a computing device lacking a virtual environment. The at least one application106may seek a connection to exchange data with an application of a remote computing device connected to physical device102via a networking fabric. To receive return traffic from the remote device, application106might not request any specific port of the physical device102, and instead may allow the network/IP stack108to shield port allocation and usage from the application106. Network/IP stack108automatically tracks and identifies return traffic directed to the application106.

In various embodiments, the network/IP stack108of each virtual machine104may be any software implementation of any protocol suite known in the art, such as the Transmission Control Protocol (TCP)/IP protocol suite. The stack108may comprise a sub-process or module for each layer, such as a module for the TCP layer, a module for IP layer, etc. Upon receiving a request from an application106for a connection to an application of a remote device, the stack108may determine an ephemeral port to associate with the application106for outbound transmission and receipt of return traffic to application106. The association, in some embodiments, may only last for the duration of a network connection. The determining may comprise inquiring of the ephemeral port configurator112to determine whether one or more ephemeral ports have been allocated to the virtual machine104. If one or more ephemeral ports have been allocated, stack108may retrieve the allocation, from, for example, a data structure associated with the stack108or the ephemeral port configurator112. If one or more ephemeral ports have not been allocated, the ephemeral port configurator112may request an allocation, and upon being notified of the allocation, may store the allocation in a data structure of the stack108or the ephemeral port configurator112, and may notify the stack108of the allocation. In other embodiments, the determining may simply comprise the stack108retrieving a range of ephemeral ports from a data structure.

As is illustrated, the ephemeral port configurator112of each virtual machine104may comprise any process or module of each virtual machine104and, in some embodiments, may be a sub-process of the network/IP stack108. The ephemeral port configurator112may receive an inquiry from the stack108to determine whether the virtual machine104has been allocated one or more ephemeral ports, as described above. If one or more ephemeral ports have not been allocated, the ephemeral port configurator112may request an allocation of one or more ephemeral ports from an ephemeral port manager118. After such an allocation is then made by the ephemeral port manager118, the ephemeral port configurator112may receive notification of the allocation from the ephemeral port manager118. The ephemeral port configurator112may then store the range of allocated ephemeral ports in a data structure, such as a data structure of ephemeral port configurator112or the stack108. Further, ephemeral port configurator112may notify the stack108of the allocation through, for example, an application programming interface (API) of the stack108. In one embodiment, the allocation lasts only for the duration of one or more network connections of the virtual machine104, and upon termination of the one or more connections, the ephemeral port configurator112may notify the ephemeral port manager118that the virtual machine104no longer requires the allocation of ephemeral ports.

In other embodiments, the ephemeral port configurator112may automatically request an allocation of ephemeral ports at initialization/startup of the virtual machine104. Upon receiving notification of the allocation, the ephemeral port configurator112may then store the allocated range where the stack108may retrieve the range. In such embodiments, the stack108need not inquire of the ephemeral port configurator112, but merely retrieve the allocated range.

In yet other embodiments, the ephemeral port configurator112may simply receive notification of an allocation of one or more ephemeral ports, without requesting the allocation. In such embodiments, the ephemeral port manager118may determine an allocation for each of the plurality of virtual machines104in response to the request of one virtual machine104, or may do so automatically at startup. Thus, an ephemeral port configurator112need not request an allocation to receive an allocation. Further, if all of the ephemeral ports of the device102have been allocated, and an additional virtual machine104requests an allocation of ephemeral ports, the ephemeral port manager118may reallocate the ephemeral ports and may notify the ephemeral port configurator112of the reallocated range of ephemeral ports.

In various embodiments, the virtual machine NIC110of each virtual machine may send packets to and receive packets from a routing module114of the physical device102, the routing module114in some embodiments managing the network hardware120. NICs for virtual machines, such as NIC110, are well known in the art. Accordingly, NIC110does not need to be described further.

In some embodiments, not illustrated, the physical device102may further comprise a virtual machine manager (VMM), which may have a service operating system (OS). The VMM and service OS may comprise a service partition of the physical device102, managing the actual hardware resources of device102and coordinating the use of the resources between the plurality of virtual machines104. In one embodiment, the ephemeral port manager118and/or the routing module114may reside in the VMM and/or the service OS. VMM's and service OS's are both well known in the art, and need not be described further.

As is illustrated, physical device102may include an ephemeral port manager118. The ephemeral port manager118may be any process, sub-process, or module of the physical device102, and in some embodiments may be a sub-process of another process, such as a sub-process of the routing module114or a service OS. In some embodiments, such as those described above, the ephemeral port manager118may reside in a service partition of the physical device102, such as a VMM. In other embodiments, the device102may instead or also include a management layer (not shown), and the ephemeral port manager118may reside in that management layer.

In various embodiments, the ephemeral port manager118may receive a request for an allocation of one or more ephemeral ports from an ephemeral port configurator112of one or more virtual machines104. The ephemeral port manager118may be considered the owner of the physical device102's pool of ephemeral ports, necessitating network stacks108of virtual machines104seeking the allocation of one or more ephemeral ports to request such an allocation from the ephemeral port manager118, in the manner described in detail above. In one embodiment, the ephemeral port manager may also receive notification from an ephemeral port configurator112that its associated virtual machine104no longer requires its allocation of ephemeral ports. The ephemeral port manager118may then mark those ports as available and notify the routing module114of the deallocation and/or update the port-to-virtual machine mappings116of the routing module114.

Upon receiving a request for an allocation of ephemeral ports, the ephemeral port manager118may allocate the ephemeral ports. In some embodiments, ephemeral port manager118may only allocate ephemeral ports to the requesting virtual machine104. If the virtual machine104requests a certain number of ephemeral ports, the ephemeral port manager118may allocate that entire number, or only some portion of that number. A requesting virtual machine104need not, however, specify a requested number of ports. In other embodiments, the ephemeral port manager118may allocate ports for each virtual machine104of the physical device102in response to a request from one virtual machine104. The ephemeral port manager118may allocate the entire pool of ephemeral ports, dividing the pool up between the virtual machines104, or may allocate only a portion of the pool of ephemeral ports, saving some portion for additional virtual machines104that have not yet been initialized on the physical device102. In yet other embodiments, the ephemeral port manager118may allocate ephemeral ports to each virtual machine104at startup rather than waiting upon a request from a virtual machine104.

In some embodiments, the ephemeral port manager118may then mark the ephemeral ports it has allocated as unavailable for future allocation requests from other virtual machines104. If the ephemeral port manager receives notification from an ephemeral port configurator112that an allocation of ephemeral ports is no longer needed, the ephemeral port manager118may mark the ports as available. The ephemeral port manager118may include a data structure, such as a database or file, or simply a data object of the ephemeral port manager118process storing a list of all of the ephemeral ports and whether each port has been allocated. In one embodiment, this data structure may be the port-to-virtual machine mapping116of the routing module114. The ephemeral port manager118may check the data structure prior to allocating ports, to determine if ports are available to allocate.

Upon allocating and marking the ephemeral ports, the ephemeral port manager118may, in some embodiments, notify the virtual machine(s)104and the routing module114of the allocation (or deallocation). The ephemeral port manager118may notify only the requesting virtual machine104of the allocation, or may notify all of the virtual machines104of the device102of the allocation. The notification may be sent, in one embodiment, to the ephemeral port configurator112of the virtual machine(s), and may specify the ports allocated to the notified virtual machine. Additionally, the ephemeral port manager118may notify the routing module114of the allocation(s) or deallocation(s) to the one or all virtual machines104. In other embodiments, rather than notifying the routing module114of the allocations or deallocation(s), the ephemeral port manager118may simply store the allocations in the port-to-virtual machine mapping116of the routing module114, facilitating the routing module114in routing incoming packets to the proper virtual machine104.

In various embodiments, if the ephemeral port manager118has allocated the entire pool of ephemeral ports, but receives a request for allocation from an additional virtual machine104, the ephemeral port manager118may reallocate the ephemeral ports among the virtual machines104, notifying each virtual machine104and the routing module114of the reallocation, and remarking the ports to reflect the reallocation.

As illustrated, the physical device102may further comprise a routing module114. The routing module114may reside in a service partition of the device102or in a management layer of the device102, and in some embodiments may reside in the same layer or partition as the ephemeral port manager118. The routing module114may be any process, sub-process, or module of the device102, and may be a sub-process of the ephemeral port manager118(or the ephemeral port manager118may be a sub-process of the routing module114). In some embodiments, the routing module114may manage the network hardware120of the device102. In other embodiments, the routing module114may instead communicate with a management process of the network hardware. Further, the routing module114may manage the virtual machine NIC110processes of the virtual machines in sending and receiving packets, thus coordinating the sharing of the network hardware120between the virtual machines104. The routing module114may also facilitate the sharing of the device102IP address between the virtual machines by determining, based on a port number included in an incoming packet, which virtual machine104the packet is destined for, and the routing module114may then route the packet to that virtual machine104through its NIC110.

In some embodiments, the routing module114may determine which virtual machine104to route incoming packets to, based on a port-to-virtual machine mapping116. The mapping116may be a data structure of the routing module114, such as a database or a file, or may be a data object of the routing module114process. The routing module114may store mappings in mapping116upon being notified of allocations and/or deallocations by the ephemeral port manager118, or may simply retrieve mappings from mapping116, the mappings having been stored by the ephemeral port manager118. Upon retrieving mappings and associating the mappings to the port identified in the incoming packets, the routing module114may route the packet to the proper virtual machine104. Routing modules coordinating resource sharing between virtual machines are well known in the art, and accordingly routing module114does not need to be described further.

As is shown, physical device102may further comprise network hardware120. In some embodiments, the network hardware120may comprise any networking interface known in the art, including Ethernet interfaces, Bluetooth interfaces, and wireless interfaces. The network hardware120may thus consist of a PC card to be received by a PC card port of physical device102, a miniPCI (mini-Peripheral Component Interconnect) wireless interface, or a radio antenna, the PC Card, miniPCI, and/or antenna facilitating wireless transmission. The network hardware120may also or instead consist of an Ethernet port of physical device102receiving an Ethernet cable, the cable further connected to, in some embodiments, a router. Further, the network hardware120may be capable of receiving data from a networking fabric and transmitting data to that networking fabric. In one embodiment, hardware120is managed by the routing module114. In other embodiments, hardware120includes its own management module, which may be communicatively coupled to the routing module114. Networking interfaces, such as network hardware120, are well known in the art, and need not be described further.

In some embodiments, physical device102may be connected to a networking fabric (not shown) via network hardware120. The networking fabric may be of any sort known in the art, such as a local area network, a wide area network, or the Internet. Depending on the network hardware120, physical device102may connect to the networking fabric, for example, via Ethernet, Bluetooth, and/or wireless technologies. The connection formed may also be of any sort known in the art, such as a TCP/IP connection or an asynchronous transfer mode (ATM) virtual connection.

In alternate embodiments, some or all of these components, i.e. the routing module, ephemeral port manager, etc., may be combined. In other embodiments, one or more of these components may be implemented as multiple components. In still other embodiments, embodiments of the invention may be practiced with other additional elements.

FIG. 2illustrates a flow chart view of selected operations of the methods of various embodiments of the present invention, to enable allocation of ephemeral ports to virtual machines on a common platform or physical device. As illustrated, a method of an embodiment may involve a network/IP stack of a virtual machine of a physical device requesting an ephemeral port, and an ephemeral port configurator of the virtual machine receiving the request from the stack and requesting an allocation of ephemeral ports, blocks202-204. As discussed earlier, in various embodiments, an application of a virtual machine may request the network/IP stack of the virtual machine to establish a connection to an application of a remote device, and to select a port from a pool of ephemeral ports to receive return traffic destined for the application. The network/IP stack may then request an ephemeral port from the ephemeral port configurator of the virtual machine, block202. The ephemeral port configurator may next determine if the virtual machine has received an allocation of ephemeral ports. If the virtual machine has not received an allocation, the ephemeral port configurator may request an allocation of ephemeral ports from the ephemeral port manager of the physical device, block204. The ephemeral port manager may be responsible for allocating the pool of ephemeral ports of the physical device between the virtual machines of the device.

Upon receiving a request for an allocation of ephemeral ports, the ephemeral port manager may allocate ephemeral ports to the requesting virtual machine and/or all virtual machines of the physical device, may mark the ports allocated as unavailable after allocation, and may notify the virtual machine(s) and the routing module of the physical device of the allocation(s), blocks206-214.

More specifically, in various embodiments, the ephemeral port manager may receive the request for an allocation of one or more ports from the ephemeral port configurator of a virtual machine, block206. In response, the ephemeral port manager may allocate ephemeral ports to the requesting virtual machine or to all virtual machines of the physical device, block208. The ephemeral port manager may then mark the allocated ephemeral ports as unavailable for allocation to another requesting virtual machine, block210. Further, the ephemeral port manager may next notify the requesting virtual machine or all virtual machines of the allocation(s), the notifications provided in some embodiments to the ephemeral port configurators of the virtual machines, block212, and may also notify the routing module of the physical device of the allocation(s), block214, to facilitate the routing module in routing received packets to the appropriate virtual machine.

Upon being notified of the allocation(s) of ephemeral ports, the routing module of the physical device may store mappings representing the virtual machines and the ephemeral ports allocated to each virtual machine. The routing module may then use the mappings to route incoming packets to the proper virtual machine, block216.

Thereafter, blocks202-216are repeated until all allocation requests have been met, block218, allocating at least the requesting virtual machines allocations of ephemeral ports. Accordingly, virtual machines may effectively share an IP address of a physical device and a pool of ephemeral ports through an ephemeral port manager allocating ephemeral ports to the virtual machines.

FIG. 3illustrates an example computer system suitable for use to practice various embodiments of the present invention. As shown, computing system300includes one or more processors302, and system memory304. Additionally, computing system300includes mass storage devices306(such as diskette, hard drive, compact disc read only memory (CD-ROM) and so forth), input/output devices308(such as keyboard, cursor control and so forth) and communication interfaces310(such as network interface cards, modems and so forth). The elements are coupled to each other via system bus312, which represents one or more buses. In the case of multiple buses, they are bridged by one or more bus bridges (not shown). In various embodiments, mass storage devices306may be divided into multiple partitions for use by the virtual machines, with each virtual machine having exclusive use of the assigned partition.

Each of these elements performs its conventional functions known in the art. In particular, system memory304and mass storage306may be employed to store a working copy and a permanent copy of the programming instructions implementing the various components of the various virtual machines and of the computer system, herein collectively denoted as322. As described earlier, the various components may include an ephemeral port manager, a routing module, and/or one or more ephemeral port configurators. The various components may be implemented as assembler instructions supported by processor(s)302or high level languages, such as C, that can be compiled into such instructions.

The permanent copy of the programming instructions may be placed into permanent storage306in the factory, or in the field, through, for example, a distribution medium (not shown), such as a compact disc (CD), or through communication interface310(from a distribution server (not shown)). That is, one or more distribution media having one or more of an implementation of the ephemeral port manager, an implementation of the routing module, and one or more implementations of the ephemeral port configurators may be employed to distribute these components and program various computing devices.

The constitution of these elements302-312are known, and accordingly will not be further described.

Although specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that a wide variety of alternate and/or equivalent implementations may be substituted for the specific embodiments shown and described, without departing from the scope of the embodiments of the present invention. This application is intended to cover any adaptations or variations of the embodiments discussed herein. Therefore, it is manifestly intended that the embodiments of the present invention be limited only by the claims and the equivalents thereof.