WO2016095762A1

WO2016095762A1 - Virtual machine access control method and virtual machine access control system

Info

Publication number: WO2016095762A1
Application number: PCT/CN2015/097177
Authority: WO
Inventors: 章宇; 魏治安
Original assignee: 华为技术有限公司
Priority date: 2014-12-17
Filing date: 2015-12-11
Publication date: 2016-06-23
Also published as: CN104731635B; CN104731635A

Abstract

A virtual machine access control method and a virtual machine access control system. The virtual machine access control system (900) comprises at least one mapper (901) and at least two access agents (902), and the mapper (901) is used for establishing mappings between processes and the access agents (902) corresponding to the processes. The method comprises: a first access agent receives an access request generated by a process that has a mapping with the first access agent (101), wherein the first access agent is any one of the access agents in the virtual machine access control system; and the first access agent sends the access request to a destination terminal specified by the access request (102). The access agents (902) receive access requests generated by the processes corresponding to the access agents (902), the access requests sent outwards by the access agents (902) are in parallel, that is to say, the access requests generated by the processes corresponding to different access agents (902) are executed in parallel, and therefore the performance of a virtual machine is improved.

Description

Virtual machine access control method and virtual machine access control system

Technical field

The present invention relates to the field of communications technologies, and in particular, to a virtual machine access control method and a virtual machine access control system.

Background technique

The volume access performance (read and write performance) of a virtual machine (VM) is an important indicator of virtual machine performance. Therefore, increasing the volume read and write bandwidth of a virtual machine is important for the performance of applications running on virtual machines. At the same time, virtual machine volume read and write performance management is also an important part of virtual machine performance quality of service (QoS).

Currently, virtual machine access volumes use serial access, such as a kernel-based virtual machine (KVM) hypervisor, and block storage uses mainstream storage devices or open source storage technologies. Open source storage technologies such as Logical Volume Manager (LVM).

The implementation of serial access is as follows: There are many processes (Process, Proc) running on the virtual machine, and the process will generate data access operations. These data access operations may be directed to the same volume, that is, data access operations for a single volume. Data access requests from multiple processes are obtained by the virtual machine's disk controller and sent serially to a single volume, which is then received by the disk controller to return the access results and forwarded to the process corresponding to each access result.

Any VM can be connected to one or more volumes. Each volume is controlled by one controller. All processes on this virtual machine access to a volume must be sent serially through the disk controller of the volume. The volume disk controller is a module of the virtual machine hypervisor and can be implemented in software.

The above serial access scheme can avoid the problem that the access operation is sent out in parallel to cause the access result to be out of order and thus introduce a potential error, but the serial access speed is slow, which seriously affects the performance improvement of the virtual machine.

Summary of the invention

The embodiment of the invention provides a virtual machine access control method, and a virtual machine access control system, which is used to improve the access speed of the virtual machine to the storage device and improve the performance of the virtual machine.

An embodiment of the present invention provides an access control method, where the method is applied to a virtual machine access control system, where the virtual machine access control system includes at least one mapper and at least two access agents, and the mapper is used to establish a mapping relationship between a process and an access agent corresponding to the process, the method includes:

The first access agent receives an access request generated by a process that is in a mapping relationship with the first access agent; the first access agent is any access agent in the virtual machine access control system;

The first access agent sends the access request to a destination specified by the access request.

In combination with the implementation of the aspect, in a first possible implementation, the virtual machine access control system includes the number of the mappers; the virtual hardware interface of the mapper and the virtual machine access control system All processes managed establish a communication connection.

In combination with the implementation of the aspect, in a second possible implementation manner, the virtual machine access control system includes the same number of the mappers as the number of the access agents;

The mapper is driven by the driver context of the mapper to establish a communication connection with the process; the mapper is configured to establish a mapping relationship between the process and the access proxy corresponding to the process, including: the mapper is to be mapped The process maps to a virtual hardware interface of the access agent corresponding to the process to be mapped, and the process to be mapped is a process of establishing a communication connection with the mapper.

In conjunction with the second possible implementation of the aspect, in a third possible implementation, the mapper maps the to-be-mapped process to the virtual hardware interface of the access proxy corresponding to the to-be-mapped process, including:

The mapper receives the configuration information, and maps the to-be-mapped process to a virtual hardware interface of the access proxy corresponding to the to-be-mapped process according to the configuration information.

In conjunction with the first or second possible implementation of the aspect, in a fourth possible implementation, the mapper includes an application binary interface ABI; the ABI includes: a protocol standard ABI, a configuration interface ABI, At least two hardware interfaces ABI;

The protocol standard ABI is used to specify the at least two hardware interfaces ABI and the communication protocol used by the configuration interface ABI; the configuration interface ABI is for receiving configuration information.

In combination with the first, second, or third possible implementation of the aspect, in a fifth possible implementation, the process includes a process identification ID and is used to identify the process from the system. State or user state status identifier; a process with the same process ID is a process, or a process with the same process ID and the same status ID is a process.

In conjunction with the first, second, or third possible implementation of the aspect, in a sixth possible implementation, the access request is sent to the access by the first access proxy. Before requesting the specified destination, it also includes:

The first access proxy caches the received access request;

Sending, by the first accessing proxy, the access request to the destination specified by the access request includes:

Transmitting, by the first access proxy, the cached access request to the destination specified by the access request in descending order of the priority of the process for generating the access request; or the first access proxy is in accordance with the principle of first in first out Sending the cached access request to the destination specified by the access request.

In conjunction with the first, second, or third possible implementation of the aspect, in a seventh possible implementation, the access request is sent by the first access proxy to the access Before requesting the specified destination, it also includes:

The first accessing agent sends an authentication request to the destination end of the access request, and after receiving the license information passed by the authentication, the license information is added in the access request.

A second embodiment of the present invention provides a virtual machine access control system, where the virtual machine access control system includes: at least one mapper and at least two access agents;

The mapper is configured to establish a mapping relationship between a process and an access agent corresponding to the process;

Each access agent includes:

a receiving unit, configured to receive an access request generated by a process that is mapped to the access agent;

And a sending unit, configured to send the access request to the destination end specified by the access request.

In combination with the implementation of the two aspects, in a first possible implementation manner, the virtual machine access control system includes the number of the mappers; the virtual hardware interface of the mapper and the virtual machine access control system All processes managed establish a communication connection.

In combination with the implementation of the second aspect, in a second possible implementation manner, the virtual machine access control system includes the same number of the mappers as the access agent; the mapper is configured by the mapper After the driver context is driven, establish a communication connection with the process;

The mapper is specifically configured to map a process to be mapped to a virtual hardware interface of an access proxy corresponding to the to-be-mapped process, where the to-be-mapped process is a process of establishing a communication connection with the mapper.

In combination with the second possible implementation of the second aspect, in a third possible implementation manner, The mapper includes:

An information receiving unit, configured to receive configuration information;

And a mapping subunit, configured to map the to-be-mapped process to a virtual hardware interface of the accessing proxy corresponding to the to-be-mapped process according to the configuration information received by the information receiving unit.

In conjunction with the first or second possible implementation of the second aspect, in a fourth possible implementation, the mapper includes an application binary interface ABI; the ABI includes: a protocol standard ABI, a configuration interface ABI, At least two hardware interfaces ABI; the protocol standard ABI is used to specify the at least two hardware interfaces ABI and the communication protocol used by the configuration interface ABI;

The configuration interface ABI is configured to receive configuration information.

In combination with the second aspect, the first, the second, or the third possible implementation of the second aspect, in a fifth possible implementation, the process includes a process identifier ID and is used to identify that the process is from a system state Or user status status identifier;

The mapper is further configured to determine that processes having the same process ID and having different state identifiers belong to different processes, or that processes having the same process ID belong to one process.

In combination with the second aspect, the first, the second, or the third possible implementation of the second aspect, in a sixth possible implementation, the accessing the proxy further includes:

a cache unit, configured to cache the received access request before the sending unit sends the access request to the destination end specified by the access request;

The sending unit is specifically configured to sequentially send the cached access request to the destination specified by the access request according to the priority of the process that generates the access request; or, the cached access according to the first in first out principle The request is sent to the destination specified by the access request.

In combination with the second aspect, the first, the second, or the third possible implementation of the second aspect, in a seventh possible implementation, the accessing the proxy further includes:

An authentication unit, configured to send an authentication request to the destination end of the access request top before the sending unit sends the access request to the destination end specified by the access request;

The adding unit adds the license information to the access request after receiving the license information passed by the authentication.

As can be seen from the above technical solution, the embodiment of the present invention has the following advantages: the mapper establishes a mapping relationship between the process and the access proxy, and then the access proxy receives the access request generated by the corresponding process, and then the access proxy Inter-access requests are all in parallel, that is, corresponding to different The access requests generated by the process of accessing the agent are executed in parallel, so that the access speed of the virtual machine to the storage device can be improved, and the performance of the virtual machine can be improved.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying for inventive labor.

1 is a schematic flowchart of a method according to an embodiment of the present invention;

2A is a schematic structural diagram of a system according to an embodiment of the present invention;

2B is a schematic structural diagram of a system according to an embodiment of the present invention;

2C is a schematic structural diagram of a system according to an embodiment of the present invention;

3 is a schematic structural diagram of a distributed block storage system according to an embodiment of the present invention;

4 is a schematic structural diagram of a virtual disk controller according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an ABI design according to an embodiment of the present invention; FIG.

6 is a schematic diagram of an internal structure of an access proxy according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of an access sequence process according to an embodiment of the present invention;

8 is a schematic structural diagram of another virtual disk controller according to an embodiment of the present invention;

9 is a schematic structural diagram of a system according to an embodiment of the present invention;

10 is a schematic structural diagram of a system according to an embodiment of the present invention;

11 is a schematic structural diagram of a system according to an embodiment of the present invention;

12 is a schematic structural diagram of a system according to an embodiment of the present invention;

13 is a schematic structural diagram of a system according to an embodiment of the present invention;

FIG. 14 is a schematic structural diagram of an access control apparatus according to an embodiment of the present invention.

detailed description

The present invention will be further described in detail with reference to the accompanying drawings, in which . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

An embodiment of the present invention provides an access control method. As shown in FIG. 2A, FIG. 2B, and FIG. 2C, the foregoing method is applied to a virtual machine access control system, where the virtual machine access control system includes at least one mapper and at least two accesses. The proxy is used to establish a mapping relationship between the process and the access proxy corresponding to the process. In this embodiment, different processes may be identified by using a process identifier (Identity, ID), or may be a process ID and It is identified by a status identifier that identifies the above process from a system state or a user state. The two ways of distinguishing different processes do not affect the implementation of the embodiment of the present invention, and the latter mode can be used as a preferred implementation. In addition, the virtual machine access control system is part of a hypervisor that manages access to data storage volumes by various processes running on the virtual machine. As shown in FIG. 1, the above method includes:

101: The first access proxy receives an access request generated by a process that is mapped to the first access proxy; the first access proxy is any access proxy in the virtual machine access control system;

102: The first access proxy sends the access request to the destination specified by the access request.

In the configuration diagrams shown in FIGS. 2A to 2C, the direction of the arrow is the transmission direction of the access request, and the result of the access is the reverse direction of the transmission direction of the access request.

In this embodiment, the mapper establishes a mapping relationship between the process and the access proxy, and then the access proxy receives the access request generated by the corresponding process, and then the outgoing access requests between the access agents are parallel, That is, the access requests generated by the processes of the different access agents are executed in parallel, so that the access speed of the virtual machine to the storage device can be improved, and the performance of the virtual machine can be improved.

In the embodiment of the present invention, the correspondence between the access agent and the process may be specifically as follows: one access agent corresponds to one process, or one access agent corresponds to a set number of processes, and the higher priority of the process is set. The smaller the number, the above the number of settings is greater than one.

2A and 2C are schematic diagrams of an access proxy corresponding to a process, and FIG. 2B is a schematic diagram of an access proxy corresponding to a set number of processes. Looking at the entire virtual machine access control system, whether it is FIG. 2A or FIG. 2B, the access requests between the access agents are all parallel; wherein the access requests between the processes of FIG. 2A are also parallel.

In the embodiment of the present invention, the number of mappers can be arbitrarily set, as follows: the number of the mappers included in the virtual machine access control system is one; the virtual hardware interface of the mapper and the virtual machine access control system are managed. All processes establish a communication connection.

In the embodiment of the present invention, the number of mappers can be arbitrarily set, as follows: the virtual machine access control system includes the same number of mappers as the number of access agents; the mapper is configured by The drive context of the mapper is driven to establish a communication connection with the process;

The mapper is configured to establish a mapping relationship between the process and the access proxy corresponding to the process, where the mapper maps the to-be-mapped process to a virtual hardware interface of the access proxy corresponding to the to-be-mapped process, where the to-be-mapped process is The above mapper establishes the process of the communication connection.

2A and 2B contain only one mapper, and FIG. 2C includes multiple mappers. The scheme of using multiple mappers is to prevent the access request of all processes from being sent to this mapper when only one mapper is included. The access request is serialized on the virtual hardware interface of this mapper, which may be protected by virtual hardware interface. The limitations of the virtual machine access control system can not be maximized. Thus the structure shown in Figure 2C can be used as a preferred implementation.

The mapping between the process and the access agent can be fixed or configurable. If it is configurable, the initial quality of service (QoS) management can be implemented for each process. Specifically, if the number of the mappers is the same as the number of access agents, the mapper maps the to-be-mapped process to the hardware interface of the access proxy corresponding to the to-be-mapped process, including:

The mapper receives the configuration information, and maps the to-be-mapped process to the hardware interface of the access proxy corresponding to the to-be-mapped process according to the foregoing configuration information.

The embodiment of the present invention further provides an optional implementation of the interface of the mapper as follows: the mapper includes an application binary interface ABI; the ABI includes: a protocol standard ABI, a configuration interface ABI, and at least two hardware interfaces ABI;

The above protocol standard ABI is used to specify the communication protocol used by the at least two hardware interfaces ABI and the configuration interface ABI; the configuration interface ABI is configured to receive configuration information.

In some operating systems, the process identifier (Identity, ID) space of the system state and the user state process may overlap, that is, in the system state and the user state, there are processes with the same process ID, in order to more accurately determine different processes, The embodiment of the invention further provides the following solution: the foregoing process includes a process identifier ID and a state identifier for identifying the process from the system state or the user state; the process with the same process ID is a process, or has the same process ID and has The process identified by the same state is a process. The latter solution can determine different processes more accurately. It can be understood that in the latter scheme, having the same process ID but different status identifiers belongs to different processes.

The embodiment of the present invention further provides a technical solution for buffering an access request to implement management of an access request, as follows: the first access proxy sends the access request to the destination specified by the access request. Before the end, it also includes:

The first access proxy caches the received access request;

The foregoing first access proxy sends the foregoing access request to the destination specified by the access request, including:

The first access proxy sends the cached access request to the destination specified by the access request in order from the highest priority to the priority of the process that generates the access request; or the first access proxy caches according to the first in first out principle The access request is sent to the destination specified by the above access request.

The specific cache mode may be a cache queue manner, or other cache manners may not be used in this embodiment. The QoS management of the process can be realized by caching the access request in the access proxy and then transmitting the request by the access policy.

Since the number of the main body of the access request is more than one in the embodiment, the embodiment further provides an implementation scheme for the access proxy to perform authentication, which is specifically as follows: the first access proxy sends the access request to the destination specified by the access request. Previously, it also included:

The first access agent sends an authentication request to the destination end of the access request, and after receiving the license information passed the authentication, adds the license information to the access request.

The following embodiments will be given as a specific application scenario, and the embodiments of the present invention will be described in more detail.

As shown in FIG. 3, the current volume adopts the logical structure of the distributed block storage system, and may also be referred to as the logical structure of the distributed block storage resource pool. The hardware part of the distributed block storage resource pool, which mainly contains multiple general-purpose servers. There are multiple physical hard disks on each server, namely: Hard Disk Drive (HDD). Each physical hard disk is combined with a daemon running on a general-purpose server for the physical hard disk to form a logical object storage. (Object Storage Device, OSD). A volume logically contains a large number of data blocks that are mapped to corresponding object storage. After the access request generated by the process (Proc) reaches the controller of the VM, the VM sends the access request to the data block in the volume, such as a dotted connection relationship, or directly to the data block specified by the access request.

In this embodiment, a virtual disk controller based on a parallel architecture (corresponding to the controller in FIG. 3) and a driver corresponding to the disk controller are introduced on the virtual machine side to eliminate a single point performance bottleneck on the virtual machine side. Enables multiple processes on a virtual machine to access multiple blocks of a volume in parallel to improve performance. In addition, in this embodiment, in the virtual disk controller based on the parallel architecture, by introducing an access policy control mechanism, the volume read and write performance of each process can be controlled.

This embodiment is mainly implemented on the VM side. The following embodiments will give two example implementations on the VM side. For an example of the scheme, the structure shown in FIG. 3 can be referred to together.

Figure 4 shows the logical structure inside the virtual disk controller based on the parallel architecture. In Figure 4, the operating system is the client user operating system of the virtual machine, and the hypervisor is the hypervisor of the virtual machine. Controller (that is, virtual disk controller). In Figure 4, three processes (Proc0 ~ Proc2) are illustrated, each process is connected to a mapper driven by a drive context, the mapper is connected to a virtual hardware interface, the virtual hardware interface is connected to an access proxy, and the access proxy is connected to the storage. A system, such as the distributed block storage resource pool in Figure 3.

In FIG. 4, the virtual disk controller on the virtual machine side adopts a multi-process parallel structure, and the logical entity corresponding to each process is an access agent. The access agent has a one-to-one correspondence with the virtual hardware interface. The access agent interacts with the driver-driven mapper in the guest operating system through its corresponding virtual hardware interface, so there is an independent logic for each process. Channel, the downstream direction of the access request in the logical channel is: process, mapper, virtual hardware interface, and finally forwarded to the destination specified by the access request by the access proxy. Therefore, each process can access a distributed block storage resource pool through a separate logical channel.

The administrator can configure the virtual hardware interface in the interface module through the management module of the virtual disk controller shown in FIG. 4, and can also configure the access agent. The specific implementation of the configuration may be a virtual hardware configuration and management mode, and access to the virtual registers by the guest system inside the VM. The specific content of the configuration may include a protocol to be used, a port number used for communication, and the like. The specific content is not limited in this embodiment.

The controller driver module in the guest operating system reads the configured information through the configuration module. The configuration information read by the configuration module may include: the number of virtual hardware interfaces, and the starting hardware address of each virtual hardware interface. Because there is a correspondence between the drive context and the virtual hardware interface. Specifically, each driver context is told by the configuration module which virtual hardware interface should be accessed. To do this, the configuration module needs to first read out the number of virtual hardware interfaces from the management module to determine that it can support up to several drive contexts. Then, the starting addresses of different virtual hardware interfaces are respectively configured to the respective driving contexts to implement separate access of the driving context to the interfaces.

In the structure shown in FIG. 4, the number of processes and the number of access agents are equal, so each process can correspond to one access agent, and if the number of processes is less than the number of access agents, each process can correspond to one access agent. ; However, if the number of processes is greater than the number of access agents, there will be multiple processes corresponding to one access agent. When the number of processes is less than or equal to the number of access agents, all The access to the volume is completely parallel; when the number of processes is greater than the number of access agents, multiple agents are still in parallel, and the processes responsible for the same access agent are serial.

In order to implement control commands and data interaction between the driver context in the guest operating system and the virtual hardware interface of the interface module of the virtual disk controller in the hypervisor, this embodiment designs an ABI for the virtual disk controller ( Application binary interface, application binary interface, and develop the driver context accordingly. The ABI design is shown in Figure 5, including: protocol standard ABI, configuration interface ABI, virtual hardware interface 0 ~ virtual interface N ABI. The interface ABI corresponds to a physical address range.

In this embodiment, the ABI is designed to be compatible with the system architecture specification, and currently uses a Peripheral Component Interconnect Express (PCI-e) bus protocol, so that the operating system correctly recognizes the virtual hardware interface of the virtual disk controller. The ABI is designed to provide a configuration read and write interface ABI for the controller driver module in the guest operating system. The designed ABI provides a separate ABI for each virtual hardware interface to allow multiple process drive contexts to access multiple virtual hardware interface ABIs in parallel.

In the implementation of the virtual disk controller, the access agent is the core structure. The internal structure of the access agent is shown in Figure 6. It includes the following sections:

Read and write queue: The read/write request received by the virtual hardware interface is sent to the read/write queue. The read/write request is for the read and write task of the data block. The read/write queue can record the current read and write requests in the read/write queue. status.

Configuring an interface module: An interface module that can be used to receive configuration information sent by the management module and send configuration information to the module to be used. The configuration information may include: configuration information of the access policy, configuration information of the cluster authentication, and the like.

Access Policy Module: This module determines the execution policy of read and write requests in the read/write queue according to the access policy, such as First-In First-Out (FIFO) policy, priority control policy, and so on. The access policy can be determined according to the access policy configuration information sent by the receiving configuration interface.

There are usually two types of access policies: FIFO and priority scheduling. If priority scheduling is used, I/O access requests from different processes are given different priorities. The access policy module sorts the accesses according to different priority values. The way the priority value is specified is not limited and can usually be specified directly by the system administrator. In this embodiment, the FIFO policy can be adopted by default, and the access policy module can be configured to adjust to the priority scheduling.

Cluster Access Authentication Module: This module replicates the authentication on behalf of the access agent and the distributed storage resource pool. The authentication process can be as follows: The cluster access authentication module sends an authentication request to the distributed storage resource pool. The information carried in the authentication application includes: the IP address of the storage cluster authentication module, the user name, and the user password. If the distributed storage resource pool allows the authentication application, the authentication permission information (such as the byte string of the identity access authority and the authority information) is returned, and the cluster access authentication module is used, and the cluster access authentication module can notify the cluster to read and write. The module can start performing read and write requests to read and write operations on the above distributed storage resource pool. The cluster access authentication module needs to notify the cluster read/write module of the above authentication permission information.

Cluster read/write module: After the cluster access authentication module passes the authentication, the module executes the read/write request in the read/write queue according to the execution policy determined by the access policy module. The execution process may be: appending the above authentication permission information to the read/write request, and sending the information to the distributed storage resource pool.

The embodiment of the invention can also solve the out-of-sequence problem that may be caused by the read and write operations of the same data block from the same process. Specifically, as shown in FIG. 7, Proc1 issues write requests and read requests, and read requests and write requests are sent to different access agents: access agent A and access agent B, and access disorder may occur, causing an error. The process shown in Figure 7 is as follows:

1. The process Proc1 generates write requests and read requests for the same data block. The write request is first.

2. The data read operation corresponding to the read request is processed by the access agent A, and the data write operation corresponding to the write request is processed by the access agent B. The data read operation advances to the corresponding data block prior to the data write operation.

Based on the above flow, the read data is returned to Proc1, and the read data obtained by Proc1 is actually the old data before the data operation is written, resulting in an error.

Based on the out-of-order error that may be generated by the above process, the structure shown in FIG. 4 proposed by the embodiment of the present invention solves the access disorder error. In Figure 4, a mapping mechanism between processes and access agents is introduced. Specifically, by mapping all access requests from the same process to the same access agent, the access operation of the same process can be guaranteed to be serial, thereby ensuring the correctness of the access operation.

In addition, in some operating systems, the process ID space of the client mode and the user state process may overlap, that is, the process with the same process ID exists in the system state and the user mode. In order to uniquely determine the process at the time of mapping, this embodiment needs the following information when determining the process:

(1) Whether the current access is from system state or user mode.

(2) The process ID of the current access.

Information about the above processes can be obtained by the virtual hard disk driver through the guest operating system. The mapping mechanism and the policy between the specific process and the accessing agent can be selected through configuration, and the specific embodiment of the present invention is not limited.

In addition, in the structure shown in FIG. 4 and FIG. 6, by performing access policy control on multiple read/write queues of multiple access agents, QoS control of read and write performance of different processes can be realized.

The embodiment of the present invention also provides another alternative implementation of the simplified architecture with respect to the structure shown in FIG. This embodiment can be applied to a scenario in which a controller driver in a guest operating system cannot be replaced, or a plurality of fully parallel drive contexts cannot be supported. A schematic diagram of the implementation of the simplified architecture of this embodiment is shown in FIG. 8.

With the simplified architecture shown in Figure 8, no modifications can be introduced on the guest operating system side. Comparing the structure shown in FIG. 4, multiple processes are connected to the mapper through the same virtual hardware interface, and the mapper maps the process to the access proxy corresponding to each process. Although multiple processes access to the controller are serial, and the controller's access to the data block through multiple access agents is still parallel, volume access performance can still be improved. If the virtual hardware interface has no lock protection in the operating system of the client, then the structure shown in FIG. 8 can be used to obtain better results. If the client's operating system has lock protection for the virtual hardware interface, the read and write requests of multiple processes will have serial performance loss on the virtual machine hardware interface. In this case, the structure shown in Figure 4 can break through the string. The problems caused by the line enable the entire system to achieve parallelism for the best read and write performance.

The embodiment of the present invention further provides a virtual machine access control system, as shown in FIG. 9A or 9B, including a virtual machine access control system 900. The virtual machine access control system 900 includes at least one mapper 901 and at least two accesses. Agent 902;

The mapper 901 is configured to establish a mapping relationship between the process and the access proxy 902 corresponding to the process.

Each of the above access agents 902 includes:

The receiving unit 9021 is configured to receive an access request generated by a process that is mapped to the access proxy 902.

The sending unit 9022 is configured to send the access request to the destination end specified by the access request.

In this embodiment, the mapper establishes a mapping relationship between the process and the access proxy, and then the access proxy receives the access request generated by the corresponding process, and then the outgoing access requests between the access agents are parallel, That is, access requests generated by processes corresponding to different access agents are executed in parallel. Therefore, the access speed of the virtual machine to the storage device can be improved, and the performance of the virtual machine can be improved.

Optionally, in the embodiment of the present invention, the number of the mappers may be arbitrarily set, as follows: as shown in FIG. 9A, the number of the mappers 901 included in the virtual machine access control system 900 is one; The virtual hardware interface of 901 establishes a communication connection with all processes managed by the virtual machine access control system 900 described above.

Optionally, in the embodiment of the present invention, the number of mappers can be arbitrarily set, as follows: as shown in FIG. 9B, the number of the mappers 901 and the number of access agents 902 included in the virtual machine access control system 900 are as shown in FIG. 9B. The same; the mapper 901 is driven by the driving context of the mapper 901 to establish a communication connection with the process;

The mapper 901 is specifically configured to map a process to be mapped to a virtual hardware interface of the access proxy 902 corresponding to the to-be-mapped process, where the to-be-mapped process is a process of establishing a communication connection with the mapper 901.

The scheme of using multiple mappers is to prevent the access request of all processes from being sent to this mapper when only one mapper is included. The access request is serialized on the virtual hardware interface of this mapper, which may be protected by virtual hardware interface. The limitations of the virtual machine access control system can not be maximized. Thus the structure shown in Figure 9B can be used as a preferred implementation.

The mapping relationship between the process and the access agent can be fixed or configurable. If it is configurable, the initial QoS management can be implemented for each process through configuration. Specifically, as shown in FIG. 10, the mapper 901 includes:

The information receiving unit 1001 is configured to receive configuration information.

The mapping sub-unit 1002 is configured to map the to-be-mapped process to the virtual hardware interface of the accessing proxy 902 corresponding to the to-be-mapped process according to the configuration information received by the information receiving unit 1001.

The embodiment of the present invention further provides an optional implementation of the interface of the mapper as follows: Optionally, as shown in FIG. 11, the mapper 901 includes an application binary interface ABI; the ABI includes: a protocol standard ABI, and a configuration interface. ABI, at least two hardware interfaces ABI; the above protocol standard ABI is used to specify the communication protocol used by the at least two hardware interfaces ABI and the configuration interface ABI;

In some operating systems, the process ID space of the system state and the user state process may overlap, that is, the process with the same process ID exists in the system state and the user state. In order to determine different processes more accurately, the embodiment of the present invention further provides The following solution: further, the above process contains the process identification ID and uses A flag indicating that the process is from a system state or a user state;

The mapper 901 is further configured to determine that processes having the same process ID and having different state identifiers belong to different processes, or that processes having the same process ID belong to one process.

Further, the embodiment of the present invention further provides a technical solution for the cache access request to implement the management of the access request, as follows: As shown in FIG. 12, the access proxy 902 further includes:

The buffer unit 1201 is configured to cache the received access request before the sending unit 9022 sends the access request to the destination end specified by the access request.

The sending unit 9022 is configured to send the cached access request to the destination specified by the access request in sequence according to the priority of the process that generates the access request, or to cache the access request according to the first in first out principle. Send to the destination specified by the above access request.

In the embodiment of the present invention, the specific cache mode may adopt a cache queue manner, and other cache manners may not be used in this embodiment. The QoS management of the process can be realized by caching the access request in the access proxy and then transmitting the request by the access policy.

Further, since the number of the main body of the access request is more than one in the embodiment, the embodiment further provides an implementation scheme for the access proxy to perform the authentication, as follows: As shown in FIG. 13, the access proxy 902 further includes:

The authentication unit 1301 is configured to send an authentication request to the destination end of the access request before the sending unit 9022 sends the access request to the destination end specified by the access request;

The adding unit 1302 adds the license information to the access request after receiving the license information passed the authentication.

Optionally, in the embodiment of the present invention, the correspondence between the access proxy and the process may be specifically as follows: the mapper 901 is specifically configured to map a process to an access proxy 902, or may set a number. The process is mapped to an access agent 902, and the higher the priority of the process, the smaller the number of settings, and the number of settings is greater than one.

The embodiment of the present invention further provides a virtual machine access control device, which is applied to a virtual machine access control system, as shown in FIG. 14, including: a processor 1401 and a memory 1402; wherein the memory 1402 can be used by the cache processor 1401. Data generated during data processing or data required during data processing;

The processor 1401 is configured to construct the virtual machine access control system, where the virtual machine access control system includes at least one mapper and at least two access agents, where the mapper is used to establish a process and a mapping relationship between access agents corresponding to the foregoing process; the first access proxy receives an access request generated by a process that is mapped to the first access proxy; and the first access proxy is any access in the virtual machine access control system a proxy; the first access proxy sends the access request to the destination specified by the access request.

In the embodiment of the present invention, the number of mappers can be arbitrarily set, as follows: the virtual machine access control system includes the same number of mappers as the number of access agents; the mapper is driven by the drive context of the mapper. After establishing a communication connection with the process;

The mapper in the virtual machine access control system, which is configured by the processor 1401, is used to establish a mapping relationship between the process and the access agent corresponding to the process, and the mapping device maps the process to be mapped to the access corresponding to the process to be mapped. The virtual hardware interface of the proxy, the process to be mapped is a process of establishing a communication connection with the mapper.

The scheme of using multiple mappers is to prevent the access request of all processes from being sent to this mapper when only one mapper is included. The access request is serialized on the virtual hardware interface of this mapper, which may be protected by virtual hardware interface. The limitations of the access control system can not be maximized. Therefore, a virtual machine structure using multiple mappers can be used as a preferred implementation.

The mapping relationship between the process and the access agent can be fixed or configurable. If it is configurable, the initial QoS management can be implemented for each process through configuration. Specifically, if the number of the mappers is the same as the number of the access agents, the mapper in the virtual machine constructed by the processor 1401 is configured to map the to-be-mapped process to the hardware interface of the access proxy corresponding to the to-be-mapped process. Information, and mapping the process to be mapped to the above to be mapped according to the above configuration information The virtual hardware interface of the access agent corresponding to the process.

The embodiment of the present invention further provides an optional implementation of the interface of the mapper as follows: the mapper includes an application binary interface ABI; the ABI includes: a protocol standard ABI, a configuration interface ABI, at least two hardware interfaces ABI; the foregoing protocol The standard ABI is used to specify the communication protocol used by the at least two hardware interfaces ABI and the configuration interface ABI described above; the configuration interface ABI is configured to receive configuration information.

The embodiment of the present invention further provides a technical solution for buffering an access request to implement management of an access request, as follows: the first access proxy in the virtual machine access control system constructed by the processor 1401 sends the access request to the foregoing Before the destination end specified by the access request, the first access proxy caches the received access request; the first access proxy sends the access request to the destination specified by the access request, where the first access proxy generates the access request according to the request The priority of the process is sent from the highest to the lowest in order to send the cached access request to the destination specified by the access request; or the first access proxy sends the cached access request to the destination specified by the access request according to the first in first out principle. end.

Since the number of the main body of the access request is more than one in the embodiment, the embodiment further provides an implementation scheme for the access agent to perform authentication, which is specifically as follows: the first access agent in the virtual machine access control system constructed by the processor 1401. Before transmitting the access request to the destination end specified by the access request, the first access proxy sends an authentication request to the destination end of the access request, and after receiving the license information passed the authentication, adding the license information to the access request. in.

In the above embodiment, multiple processes in a single virtual machine can be used to concurrently access a single volume, thereby significantly increasing the access bandwidth of the virtual machine to the volume. QoS management that supports process-level access to multiple processes within a single virtual machine.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the above units is only a logical function division, and the actual implementation may have another The manner of division, such as multiple units or components, may be combined or integrated into another system, or some features may be omitted or not performed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents of the technical solutions of the embodiments of the present invention.

Claims

An access control method, characterized in that the method is applied to a virtual machine access control system, the virtual machine access control system comprising at least one mapper and at least two access agents, the mapper for establishing a process and the Mapping relationship between access agents corresponding to the process, the method includes:

The first access agent receives an access request generated by a process that is in a mapping relationship with the first access agent; the first access agent is any access agent in the virtual machine access control system;

The first access agent sends the access request to a destination specified by the access request.
The method of claim 1 wherein

The number of the mappers included in the virtual machine access control system is one; the virtual hardware interface of the mapper establishes a communication connection with all processes managed by the virtual machine access control system.
The method of claim 1 wherein

The number of the mappers included in the virtual machine access control system is the same as the number of the access agents;

The mapper is driven by the driver context of the mapper to establish a communication connection with the process; the mapper is configured to establish a mapping relationship between the process and the access proxy corresponding to the process, including: the mapper is to be mapped The process maps to a virtual hardware interface of the access agent corresponding to the process to be mapped, and the process to be mapped is a process of establishing a communication connection with the mapper.
The method according to claim 3, wherein the mapping of the mapping process to the virtual hardware interface of the accessing agent corresponding to the to-be-mapped process comprises:

The mapper receives configuration information, and maps the to-be-mapped process to a virtual hardware interface of an access proxy corresponding to the to-be-mapped process according to the configuration information.
The method according to claim 2 or 3, wherein the mapper comprises an application binary interface ABI; the ABI comprises: a protocol standard ABI, a configuration interface ABI, at least two hardware interfaces ABI;

The protocol standard ABI is used to specify the at least two hardware interfaces ABI and the communication protocol used by the configuration interface ABI; the configuration interface ABI is for receiving configuration information.
A method according to any one of claims 1 to 4, characterized in that

The process includes a process identification ID and a status identifier for identifying the process from a system state or a user state; a process having the same process ID is a process, or a process having the same process ID and having the same status identifier is a process .
The method according to any one of claims 1 to 4, further comprising: before the first accessing agent sends the access request to the destination end specified by the access request, further comprising:

The first access proxy caches the received access request;

Sending, by the first accessing proxy, the access request to the destination specified by the access request includes:

Transmitting, by the first access proxy, the cached access request to the destination specified by the access request in descending order of the priority of the process for generating the access request; or the first access proxy is in accordance with the principle of first in first out Sending the cached access request to the destination specified by the access request.
The method according to any one of claims 1 to 4, further comprising: before the first accessing agent sends the access request to the destination end specified by the access request, further comprising:

The first accessing agent sends an authentication request to the destination end of the access request, and after receiving the license information passed by the authentication, the license information is added in the access request.
A virtual machine access control system, characterized in that the virtual machine access control system comprises: at least one mapper and at least two access agents;

The mapper is configured to establish a mapping relationship between a process and an access agent corresponding to the process;

Each of the at least two access agents includes:

a receiving unit, configured to receive an access request generated by a process that is mapped to the access agent;

And a sending unit, configured to send the access request to the destination end specified by the access request.
The system of claim 9 wherein:

The number of the mappers included in the virtual machine access control system is one; the virtual hardware interface of the mapper establishes a communication connection with all processes managed by the virtual machine access control system.
The system of claim 9 wherein:

The number of the mappers included in the virtual machine access control system is the same as the number of the access agents; the mapper is driven by the drive context of the mapper to establish a communication connection with the process;

The mapper is specifically configured to map a process to be mapped to a virtual hardware interface of an access proxy corresponding to the to-be-mapped process, where the to-be-mapped process is a process of establishing a communication connection with the mapper.
The system of claim 11 wherein said mapper comprises:

An information receiving unit, configured to receive configuration information;

And a mapping subunit, configured to map the to-be-mapped process to a virtual hardware interface of the accessing proxy corresponding to the to-be-mapped process according to the configuration information received by the information receiving unit.
System according to claims 10 to 12, characterized in that said mapper comprises an application a program binary interface ABI; the ABI comprises: a protocol standard ABI, a configuration interface ABI, at least two hardware interfaces ABI; the protocol standard ABI is used to specify the communication of the at least two hardware interfaces ABI and the configuration interface ABI protocol;

The configuration interface ABI is configured to receive configuration information.
The system according to any one of claims 10 to 12, wherein the process includes a process identification ID and a status identifier for identifying that the process is from a system state or a user state;

The mapper is further configured to determine that processes having the same process ID and having different state identifiers belong to different processes, or that processes having the same process ID belong to one process.
The system according to any one of claims 10 to 12, wherein the access agent further comprises:

a cache unit, configured to cache the received access request before the sending unit sends the access request to the destination end specified by the access request;

The sending unit is specifically configured to sequentially send the cached access request to the destination specified by the access request according to the priority of the process that generates the access request; or, the cached access according to the first in first out principle The request is sent to the destination specified by the access request.
The system according to any one of claims 10 to 12, wherein the access agent further comprises:

An authentication unit, configured to send an authentication request to the destination end of the access request top before the sending unit sends the access request to the destination end specified by the access request;

The adding unit adds the license information to the access request after receiving the license information passed by the authentication.