WO2016184283A1 - 一种虚拟机数据流管理方法和系统 - Google Patents

一种虚拟机数据流管理方法和系统 Download PDF

Info

Publication number
WO2016184283A1
WO2016184283A1 PCT/CN2016/079465 CN2016079465W WO2016184283A1 WO 2016184283 A1 WO2016184283 A1 WO 2016184283A1 CN 2016079465 W CN2016079465 W CN 2016079465W WO 2016184283 A1 WO2016184283 A1 WO 2016184283A1
Authority
WO
WIPO (PCT)
Prior art keywords
machine
target
address
host
virtual
Prior art date
Application number
PCT/CN2016/079465
Other languages
English (en)
French (fr)
Inventor
刘华
王福海
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2016184283A1 publication Critical patent/WO2016184283A1/zh
Priority to US15/605,505 priority Critical patent/US10348624B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/66—Layer 2 routing, e.g. in Ethernet based MAN's
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/104—Peer-to-peer [P2P] networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/131—Protocols for games, networked simulations or virtual reality
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45579—I/O management, e.g. providing access to device drivers or storage
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to a virtual machine data stream management method and system.
  • Server virtualization technology enables hardware such as CPU, memory, disk, I/O (input/output, input/output port) to become a “resource pool” that can be dynamically managed, thereby improving resource utilization and allowing computer systems to serve Change is more adaptive.
  • the network communication between the virtual guest machine and the host adopts a para-virtualization scheme of a PV-driven (para-virtualization driver), that is, a back-end driver is installed on the host side, and a virtual child is installed.
  • the front-end driver is installed on the machine side, and the virtual sub-machine network communication is realized through the interaction between the front-end and the rear-end drive.
  • All the data packets sent to the virtual sub-machine or sent by the virtual sub-machine are driven by the back-end of the host side, so that the host can be The side performs packet filtering, QoS (Quality of Service), and the like for network communication of the virtual sub-machine.
  • QoS Quality of Service
  • the CPU processing load on the host side is very large, and when the Gigabit network card is used, the network Throughput, CPU consumption is still acceptable.
  • a 10 Gigabit NIC it is easy to have a CPU performance bottleneck on the host side and affect its service life, so that the processing capacity of the NIC cannot be fully utilized.
  • the technical problem to be solved by the embodiments of the present invention is to provide a virtual machine data stream management method and system, which can improve the network communication performance of the virtual machine.
  • an embodiment of the present invention provides a virtual machine data flow management method, where the method includes:
  • the host receives the IP data packet sent by the communication peer through the designated network port of the SR-IOV network card, where the target MAC address and the destination IP address in the IP data packet are respectively the MAC address and the target virtual sub-port of the designated network port of the host. IP address of the machine;
  • the host forwards the IP data packet according to the target IP address to a virtual connection function of the target virtual child machine in the same SR-IOV network card.
  • the embodiment of the present invention further provides a virtual machine data flow management method, where the method includes:
  • the target virtual sub-machine sends an IP data packet through a virtual connection function of the SR-IOV network card, where the target MAC address and the target IP address in the IP data packet are respectively the host corresponding to the target virtual sub-machine in the same SR-IOV network card.
  • the host After receiving the IP data packet through the designated network port in the SR-IOV network card, the host forwards the IP data packet to the communication peer end according to the target IP address.
  • the embodiment of the present invention further provides a virtual machine data flow management system, including a host and at least one virtual sub-machine, wherein:
  • the host is configured to receive, by using a designated network port of the SR-IOV network card, an IP data packet sent by the communication peer end, where the target MAC address and the target IP address in the IP data packet are MAC addresses of the designated network port of the host respectively. Address and the IP address of the target virtual guest;
  • the host is further configured to forward the IP data packet according to the target IP address to a virtual connection function of the target virtual sub-machine in the same SR-IOV network card.
  • the embodiment of the present invention further provides a virtual machine data flow management system, including a host and at least one virtual sub-machine, wherein:
  • the virtual sub-machine is configured to send an IP data packet by using a virtual connection function of the SR-IOV network card, where the target MAC address and the target IP address in the IP data packet are respectively the same SR of the target virtual sub-machine - the MAC address of the designated network port in the IOV network card and the IP address of the communication peer;
  • the host is configured to forward the IP data packet to the communication peer end according to the target IP address after receiving the IP data packet through a designated network port in the SR-IOV network card.
  • the MAC address of the designated network port of the virtual sub-machine corresponding to the host is configured in the IP data packet flowing through the virtual sub-machine, so that the network data of the target virtual sub-machine can be specified by the host.
  • the network port can implement packet filtering and QoS management on the network data of the target virtual sub-machine.
  • the CPU performance bottleneck of the host side is avoided or the service life is generated. Impact, fully realize the processing power of using the network card.
  • FIG. 1 is a schematic flowchart of a virtual machine data flow management method according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a virtual machine data flow management method according to another embodiment of the present invention.
  • FIG. 3 is a schematic diagram of an SR-IOV technology network card communication architecture in an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a virtual machine data flow management method according to another embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a virtual machine data flow management method according to another embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a virtual machine data flow management system according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a server according to an embodiment of the present invention.
  • FIG. 1 is a schematic flowchart of a method for managing a data flow of a virtual machine in an embodiment of the present invention. As shown in the following, the flow of a data flow management method for a virtual machine in this embodiment may include:
  • the host receives the IP data packet sent by the communication peer end through the designated network port of the SR-IOV network card, where the target MAC address and the target IP address in the IP data packet are respectively the MAC address and the target of the designated network port of the host.
  • the IP address of the virtual guest is the IP address of the virtual guest.
  • the designated network port of the host is the physical connection function of the virtual connection function (hereinafter also referred to as VF, Virtual Function) of the target virtual sub-machine in the embodiment (hereinafter also referred to as PF, Physical). Funtion), or another virtual connection function VF belonging to the same physical connection function PF as the virtual connection function VF of the target virtual sub-machine.
  • VF Virtual Function
  • PF Physical
  • Funtion another virtual connection function VF belonging to the same physical connection function PF as the virtual connection function VF of the target virtual sub-machine.
  • the communication peer sends an IP packet to the virtual slave that belongs to the same SR-IOV network card
  • the destination MAC address in the IP packet is the MAC address of the designated network port of the host corresponding to the virtual slave. Therefore, the host side can receive the IP data packet sent by the communication peer through the designated network port of the SR-IOV network card.
  • the communication peer is an external network device, that is, other network devices except the host.
  • the host forwards the IP data packet according to the target IP address to a virtual connection function of the target virtual sub-machine in the same SR-IOV network card.
  • the virtual machine data flow management method in the embodiment of the present invention is based on L2 (Layer 2, ie, data link) in a network card supporting SR-IOV (Single-Root I/O Virtualization) technology.
  • Switching logic, the SR-IOV technology network card communication architecture can be as shown in FIG. 3, before the process in this embodiment is executed, the physical connection function of the network card of the host in FIG. 3 can be used (hereinafter also referred to as PF, Physical Funtion).
  • a virtual connection function (hereinafter also referred to as VF, Virtual Function) is generated and allocated for the target virtual sub-machine, and the IP and virtual MAC addresses of the VF are allocated, and the obtained VF pass-through target virtual sub-machine is allocated.
  • the host in the embodiment of the present invention manages the mapping relationship between the VF of each virtual sub-machine and its IP.
  • the host may forward the IP data packet according to the target IP address carried by the host.
  • the target virtual sub-machine receives the IP data packet.
  • the host can perform packet filtering and QoS management on the network port, and then forward the network data that has undergone packet filtering and QoS management to the VF of the target virtual sub-machine.
  • packet filtering and QoS management can be performed on the network data sent to the target virtual sub-machine.
  • the target MAC address is set as the MAC address of the designated network port of the host corresponding to the virtual sub-machine. This can be achieved by performing the following processes 110) and 120):
  • the IP address of the target virtual sub-machine when detecting the target IP address in the ARP request received by the physical network card from the outside (such as arp_tpa, target protocol address in the ARP request message), the IP address of the target virtual sub-machine When the address is obtained, it is confirmed that the ARP request message sent to the target virtual slave is sent to the communication peer, and 120) is performed.
  • the steps of the steps 110) and 120) may be the virtual machine communication configuration module in the embodiment of the present invention.
  • the virtual machine communication configuration module may be implemented in the target virtual sub-machine or in the host. If the virtual machine communication configuration module is implemented in the target virtual child machine, and the target virtual child machine receives the ARP request message for the target virtual child machine, the virtual machine communication configuration module receives the target virtual child machine. If the ARP request message is broadcasted, the host side actually receives the ARP request, but the host side will normally receive the ARP request message. If the target IP address is not the IP address of the host side, the virtual machine communication configuration module of the host side can detect whether the target IP address in the ARP request received from the external physical network card is the IP address of the target virtual sub-machine. The address, if yes, confirms that the ARP request message sent to the target virtual slave is sent to the communication peer.
  • the target virtual sub-machine when receiving the ARP request message, sends a corresponding ARP response message to the communication peer, and the sender IP address (such as ARP) in the ARP response message.
  • the arp_spa, sender protocol address) in the response message is the IP address of the VF that is previously allocated to the target virtual machine, the sender MAC address (such as the arp_sha field in the ARP response message, sender hardware address) and the Ethernet source address (ARP).
  • the ether_shost field in the response message is the virtual MAC address of the VF that is previously allocated to the target virtual slave, so that the communication peer will according to the sender IP address and the sender MAC address (or Ethernet) in the ARP response message.
  • the network source address sends an IP data packet to the target virtual sub-machine. Because the VF in the architecture passes through the target virtual sub-machine, the host side cannot perform packet filtering and QoS on the IP data packet sent to the virtual sub-machine ( Management issues such as Quality of Service.
  • the virtual machine communication configuration module in the embodiment of the present invention sends an ARP response message to the communication peer end, where the sender MAC address or the Ethernet source address in the ARP response message is corresponding to the target virtual slave device.
  • the host specifies the MAC address of the network port, which should be answered originally.
  • the MAC address corresponding to the VF of the target virtual sub-machine in the ARP response message is replaced with the MAC address of the designated network port of the host, so that the communication peer may receive the ARP response message according to the ARP response message.
  • the IP data packet is sent to the host designated network port corresponding to the target virtual sub-machine, and the host corresponding to the target virtual sub-machine can receive the IP data sent by the communication peer through the designated network port, and then perform packet filtering on the IP data packet.
  • the network data that has undergone packet filtering and QoS management is forwarded to the VF of the target virtual sub-machine, so that packet filtering and QoS management can be performed on the network data sent to the target virtual sub-machine on the host side.
  • the APR response method allows the communication peer to send the IP data packet of the target virtual sub-machine to the designated network port of the corresponding host, which is only an optional embodiment of the present invention.
  • the mapping between the IP address of the IP address of the corresponding host and the MAC address of the network port of the corresponding host is propagated through the network. In this way, the communication peer can know that the target virtual slave corresponds to the MAC address of the designated network port of the host, and the purpose can be achieved.
  • IP data packet of the virtual sub-machine in the host designated network port of the embodiment of the present invention is implemented by configuring the MAC address, it is no longer necessary to perform the back-end driver processing on the host side to avoid the CPU performance bottleneck or the host side. Its service life has an impact, fully realize the processing power of using the network card.
  • FIG. 2 is a schematic flowchart of a method for managing a data flow of a virtual machine in another embodiment of the present invention. As shown in the following, the flow of a method for managing a data flow of a virtual machine in this embodiment may include:
  • the target virtual sub-machine sends an IP data packet by using a virtual connection function of the SR-IOV network card, where the target MAC address and the target IP address in the IP data packet are respectively the same SR-IOV as the host corresponding to the target virtual sub-machine.
  • the MAC address of the specified network port in the NIC and the IP address of the communication peer are respectively the same SR-IOV as the host corresponding to the target virtual sub-machine.
  • the target virtual sub-machine in this embodiment is similar to the previous embodiment, and the IP and virtual MAC addresses of the VF are allocated in advance, and the obtained VF pass-through target virtual sub-machine is allocated, and the target virtual sub-machine passes the VF outward.
  • Send network data The designated network port of the host belongs to the PF to which the VF of the target virtual sub-machine in the embodiment belongs or another VF that belongs to the same PF as the VF of the target virtual sub-machine.
  • the destination IP address of the IP packet is The IP address of the peer end of the standard communication, and the destination MAC address is the MAC address of the designated network port of the host corresponding to the target virtual sub-machine in the same SR-IOV network card, so that the host side can receive the specified network port of the SR-IOV network card.
  • the IP packet sent by the target virtual slave is The IP address of the peer end of the standard communication, and the destination MAC address is the MAC address of the designated network port of the host corresponding to the target virtual sub-machine in the same SR-IOV network card, so that the host side can receive the specified network port of the SR-IOV network card.
  • the host forwards the IP data packet to the communication peer end according to the target IP address after receiving the IP data packet through a designated network port in the SR-IOV network card.
  • the host can perform packet filtering and QoS management on the specified network port, and then forward the network data that has undergone packet filtering and QoS management to the communication peer.
  • packet filtering and QoS management can be performed on the network data sent by the target virtual sub-machine.
  • the target virtual MAC address is set to be the MAC address of the designated network port of the host corresponding to the virtual sub-machine. Perform the following steps 210) and 220) to achieve this:
  • the target virtual sub-machine in this embodiment is similar to the previous embodiment, and the IP and virtual MAC addresses of the VF are allocated in advance, and the obtained VF pass-through target virtual sub-machine is allocated, and the target virtual sub-machine passes the VF outward.
  • the sender IP address of the ARP request message (such as arp_spa, sender protocol address in the ARP request message) and the sender MAC address (such as arp_sha in the ARP request message) , sender hardware address) is the IP address and virtual MAC address of the VF that is allocated in advance for the target virtual sub-machine.
  • the target IP address (such as arp_tpa, target protocol address in the ARP request message) is the IP address of the target communication peer.
  • the second ARP request message may be sent by the target virtual slave according to the sender IP address and/or the sender MAC address in the ARP request.
  • the steps of the steps 210) and 220) may be the virtual machine communication configuration module in the embodiment of the present invention.
  • the virtual machine communication configuration module may be implemented in the target virtual sub-machine or in the host. If the virtual machine communication configuration module is implemented in the target virtual child machine, and the target virtual child machine sends an ARP request message, that is, an ARP request message, if needed, the virtual machine communication configuration module can learn; if the virtual machine communication
  • the configuration module is implemented in the host corresponding to the target virtual sub-machine. Since the ARP request message is broadcast, the host side actually receives the ARP request first, but the host side generally uses the target IP address in the ARP request message. The address is not the IP address of the host side.
  • the virtual machine communication configuration module on the host side can detect whether the sender IP address and/or the sender MAC address in the received ARP request is the IP address and/or MAC address of the target virtual sub-machine, and if so, That is, it is confirmed that the ARP request message sent by the target virtual sub-machine is obtained.
  • the target virtual sub-machine receives the sender MAC address or the Ethernet source address carried in the ARP response message returned by the communication peer is the MAC of the communication peer.
  • the address can then be sent IP data according to the MAC address of the communication peer.
  • the Vport of the VF pass-through physical network card under the SR-IOV technology network card communication architecture that is, the IP data sent by the target virtual sub-machine through the VF can directly pass through the Vport.
  • External transmission which causes the host side to fail to perform packet filtering, QoS (Quality of Service) management, etc. on the IP packets sent by the target virtual sub-machine.
  • the virtual machine communication configuration module in the embodiment of the present invention sends an ARP response message to the target virtual sub-machine, where the sender MAC address or the Ethernet source address in the ARP response message is the host designated network corresponding to the target virtual sub-machine.
  • the MAC address of the port that is, the spoofing of an ARP response message, replaces the actual MAC address of the communication peer corresponding to the destination IP address in the ARP request message sent by the original target virtual sub-machine with the MAC address of the designated network port of the host, so that the target virtual
  • the slave device may send the IP data packet to the host designated network port corresponding to the target virtual slave device according to the ARP response message, so that the host corresponding to the target virtual slave device may be used.
  • packet filtering and QoS management After receiving the IP data sent by the target virtual sub-machine through the designated network port, packet filtering and QoS management are performed, and then the network data that has undergone packet filtering and QoS management is sent out to the communication peer end, thereby realizing the host.
  • the side can perform packet filtering and QoS management on the network data sent by the target virtual sub-machine.
  • the target virtual sub-machine sends the outgoing IP data packet to the designated network port of the corresponding host, which is only an optional embodiment of the present invention. In other optional embodiments, Other methods can be used. For example, the target virtual sub-machine configures the destination MAC address of the IP data packet in the driver configuration to be the designated network port of the corresponding host, and the same can be achieved.
  • IP data packet of the virtual sub-machine in the host designated network port of the embodiment of the present invention is implemented by configuring the MAC address, it is no longer necessary to perform the back-end driver processing on the host side to avoid the CPU performance bottleneck or the host side. Its service life has an impact, fully realize the processing power of using the network card.
  • FIG. 4 is a schematic flowchart of a method for managing a data flow of a virtual machine in another embodiment of the present invention.
  • This embodiment focuses on how a virtual machine communication configuration module configures a MAC address to implement a network port designated by a host to pass through a target virtual sub-machine. The network data is transited.
  • the virtual machine communication configuration module in this embodiment is implemented in the target virtual sub-machine.
  • the flow of the virtual machine data flow management method in this embodiment is as follows:
  • the host allocates a virtual connection function VF to the target virtual sub-machine through the physical connection function PF of the SR-IOV network card, allocates the IP and virtual MAC address of the VF, and allocates the obtained VF pass-through target virtual sub-machine.
  • the virtual machine communication configuration module acquires an ARP request message sent by the communication peer end for the target virtual sub-machine.
  • the virtual machine communication configuration module in the embodiment is implemented in the target virtual sub-machine.
  • the virtual machine communication configuration module receives the target virtual sub-machine. ARP request message.
  • the virtual machine communication configuration module sends an ARP response message to the communication peer according to the ARP request message, where the sender MAC address or the Ethernet source address in the ARP response message is the host corresponding to the target virtual slave device. Specifies the MAC address of the network port.
  • the MAC address corresponding to the VF of the target virtual sub-machine in the ARP response message that should be answered is replaced with the MAC address of the designated network port of the host, so that the communication peer can receive the ARP response message after receiving the ARP response message.
  • the ARP response message sends the IP data packet to the host designated network port corresponding to the target virtual sub-machine.
  • the host corresponding to the target virtual sub-machine can receive the IP data sent by the communication peer through the designated network port, perform packet filtering and QoS management, and then forward the network data that has undergone packet filtering and QoS management to the target.
  • the VF of the virtual sub-machine enables packet filtering and QoS management on the network data sent to the target virtual sub-machine on the host side.
  • the host designated network port corresponding to the target virtual sub-machine is a virtual connection of the target virtual sub-machine
  • the target virtual slave device is detected to send an ARP request message.
  • the virtual machine communication configuration module in this embodiment is implemented inside the target virtual child machine, and can detect that the VF of the target virtual child machine needs to send an ARP request message according to an instruction of the operating system.
  • the virtual machine communication configuration module intercepts and blocks the target virtual slave from sending an ARP request message.
  • the virtual machine communication configuration module replaces the actual MAC address of the communication peer corresponding to the target IP address in the ARP request message sent by the original target virtual slave with the MAC address of the designated network port of the host by falsifying an ARP response message to make the target
  • the virtual sub-machine may send the IP data packet to the host designated network port corresponding to the target virtual sub-machine according to the ARP response message, and the host corresponding to the target virtual sub-machine After receiving the IP data sent by the target virtual sub-machine through the designated network port, packet filtering and QoS management are performed, and then the network data that has undergone packet filtering and QoS management is sent out to the communication peer end, thereby realizing the host.
  • the side can perform packet filtering and QoS management on the network data sent by the target virtual sub-machine.
  • the host designated network port corresponding to the target virtual sub-machine is the physical connection function PF to which the virtual connection function VF of the target virtual sub-machine belongs, or belongs to the same physical connection function PF as the virtual connection function VF of the target virtual sub-machine.
  • Another virtual connection feature is VF.
  • the virtual machine communication configuration module can obtain the MAC address of the designated network port of the host corresponding to the target virtual sub-machine after the hot migration, so that the S401 is executed later. -403 and S404-406, you can achieve the right Externally send network data to the target virtual sub-machine, and perform packet filtering and QoS management on the network data sent by the target virtual sub-machine.
  • FIG. 5 is a schematic flowchart of a method for managing a data flow of a virtual machine in another embodiment of the present invention.
  • This embodiment focuses on how a virtual machine communication configuration module configures a MAC address to implement a network port designated by a host to pass through a target virtual sub-machine. The network data is transited.
  • the virtual machine communication configuration module in this embodiment is implemented on the host side of the target virtual sub-machine.
  • the flow of the virtual machine data flow management method in this embodiment is as follows:
  • S501 The host allocates a virtual connection function VF to the target virtual sub-machine through the physical connection function PF of the SR-IOV network card, allocates the IP and virtual MAC address of the VF, and allocates the obtained VF pass-through target virtual sub-machine.
  • the virtual machine communication configuration module acquires an ARP request message sent by the communication peer for the target virtual slave.
  • the virtual machine communication configuration module in the embodiment is implemented in the host corresponding to the target virtual sub-machine. Since the ARP request message is broadcast, the host side actually receives the ARP request, but in general, the host side may In the embodiment of the present invention, the virtual machine communication configuration module on the host side can detect the target IP address in the ARP request received by the physical network card from the outside, and the target IP address in the ARP request message is not discarded. Whether it is the IP address of the target virtual sub-machine, and if so, it is confirmed that the ARP request message sent to the target virtual sub-machine sent by the communication peer is obtained.
  • the virtual machine communication configuration module sends an ARP response message to the communication peer according to the ARP request message, where the sender MAC address or the Ethernet source address in the ARP response message is the MAC address of the designated network port.
  • the target virtual sub-machine does not respond to the externally sent ARP request message, and the virtual machine communication configuration module sends an ARP response message to the external communication peer, and virtualizes the target in the ARP response message that should be answered.
  • the MAC address corresponding to the VF of the slave is replaced with the MAC address of the designated network port of the host, so that after receiving the ARP response message, the communication peer may send the IP data packet to the ARP response message according to the ARP response message.
  • the host corresponding to the target virtual sub-machine specifies a network port, and in an alternative embodiment, the host corresponding to the target virtual sub-machine can pass the designated network.
  • the port After receiving the IP data sent by the communication peer, the port performs packet filtering and QoS management, and then forwards the network data that has undergone packet filtering and QoS management to the VF of the target virtual sub-machine, thereby realizing that the host side can perform the transmission. Perform packet filtering and QoS management on the network data of the target virtual sub-machine.
  • the host designated network port corresponding to the target virtual sub-machine is the physical connection function PF to which the virtual connection function VF of the target virtual sub-machine belongs, or belongs to the same physical connection function PF as the virtual connection function VF of the target virtual sub-machine. Another virtual connection feature is VF.
  • the virtual machine communication configuration module is implemented on the host side corresponding to the target virtual sub-machine. Since the ARP request message is broadcast, the host side actually receives the ARP request first, but the host side generally uses the ARP request.
  • the virtual machine communication configuration module on the host side in the embodiment of the present invention can detect the sender IP address and/or the sender MAC address in the received ARP request in the embodiment of the present invention. Whether it is the IP address and/or MAC address of the target virtual sub-machine, and if so, it is confirmed that the ARP request message sent by the target virtual sub-machine is obtained.
  • S505 Send an ARP response message to the target virtual sub-machine according to the ARP request message, where the sender MAC address or the Ethernet source address in the ARP response message is a MAC address of the designated network port, so that the target virtual The slave sends the IP data packet to the host designated network port corresponding to the target virtual slave according to the ARP response message.
  • the virtual machine communication configuration module intercepts and blocks the target virtual slave from sending an ARP request message, and forges an ARP response message, where the sender MAC address or the Ethernet source address in the ARP response message is sent by the original target virtual slave.
  • the actual MAC address of the communication peer corresponding to the target IP address in the ARP request message is replaced with the MAC address of the host designated network port, so that the target virtual slave can receive the ARP response message according to the ARP response message.
  • the IP data packet is sent to the host designated network port corresponding to the target virtual sub-machine, and in an alternative embodiment, the host corresponding to the target virtual sub-machine can receive the IP sent by the target virtual sub-machine through the designated network port.
  • the network data that has undergone packet filtering and QoS management is sent out to the communication peer end, so that the network data that the target virtual sub-machine can send out to the host side can be performed on the host side. Packet filtering, QoS management.
  • the virtual machine communication configuration module can obtain the MAC address of the VF allocated after the hot migration of the target virtual sub-machine, so as to execute S501-503 and In S504-505, network data sent from the outside to the target virtual sub-machine and packet filtering and QoS management of the network data sent from the target virtual sub-machine can be implemented.
  • FIG. 6 is a schematic structural diagram of a virtual machine data flow management system according to an embodiment of the present invention.
  • the virtual machine data flow management system in the embodiment of the present invention may include a host 610 and a target virtual sub-machine 620, where:
  • the host 610 is configured to receive, by using a specified network port of the SR-IOV network card, an IP data packet sent by the communication peer, where the target MAC address and the target IP address in the IP data packet are respectively designated network ports of the host 610.
  • the MAC address and the IP address of the target virtual sub-machine 620 are respectively designated network ports of the host 610.
  • the virtual machine data flow management system in the embodiment of the present invention is based on L2 (Layer 2) in a network card supporting SR-IOV (Single-Root I/O Virtualization) technology.
  • the link layer) switching logic, the SR-IOV technology network card communication architecture can be as shown in FIG. 3, and the VF can be generated and allocated to the target virtual sub-machine 620 through the PF of the network card of the host 610 in FIG. 3, and the IP address of the VF is simultaneously allocated.
  • the virtual MAC address is assigned to the obtained VF pass-through target virtual sub-machine.
  • the designated network port of the host 610 is the PF to which the VF of the target virtual sub-machine 620 belongs in the embodiment, or another VF that belongs to the same PF as the VF of the target virtual sub-machine 620.
  • the target MAC address in the IP data packet is the designation of the host 610 corresponding to the target virtual child machine 620.
  • the MAC address of the network port so that the host 610 can receive the IP data packet sent by the communication peer through the designated network port of the SR-IOV network card.
  • the communication peer is an external network device, that is, other network devices than the host 610.
  • the host is further configured to forward the IP data packet to the target virtual network according to the target IP address.
  • the host in the embodiment of the present invention manages the mapping relationship between the VF of each virtual sub-machine and its IP.
  • the host may forward the IP data packet according to the target IP address carried by the host.
  • the target virtual sub-machine receives the IP data packet.
  • the host can perform packet filtering and QoS management on the network port, and then forward the network data that has undergone packet filtering and QoS management to the VF of the target virtual sub-machine.
  • packet filtering and QoS management can be performed on the network data sent to the target virtual sub-machine.
  • the virtual machine data flow management system may further include:
  • the virtual machine communication configuration module 630 is configured to obtain an ARP request message that is sent by the communication peer to the target virtual sub-machine 620, where the target IP address in the ARP request message is an IP address of the target virtual sub-machine 620; Sending an ARP response message to the communication peer according to the ARP request message, where the sender MAC address or the Ethernet source address in the ARP response message is the MAC address of the designated network port of the host 610, so that the The communication peer sends the IP data packet to the designated network port of the host 610 corresponding to the target virtual sub-machine 620 according to the ARP response message.
  • the virtual machine communication configuration module 630 can be implemented in the target virtual sub-machine 620 or in the host 610. If the virtual machine communication configuration module 630 is implemented in the target virtual child machine 620, the target virtual child machine 620 receives the ARP request message for the target virtual child machine, that is, the virtual machine communication configuration module 630 receives the target The ARP request message of the virtual sub-machine; if it is implemented in the host 610 corresponding to the target virtual sub-machine 620, since the ARP request message is broadcast, the host side actually receives the ARP request, but in general, the host 610 will Because the target IP address in the ARP request message is not the IP address of the host side, the virtual machine communication configuration module 630 in the host 610 can detect whether the target IP address in the ARP request received from the external by the physical network card is The IP address of the target virtual sub-machine 620, if yes, confirms that the ARP request message sent by the communication peer for the target virtual sub-machine 620 is obtained.
  • the target virtual sub-machine 620 in the prior art When the target virtual sub-machine 620 in the prior art receives the ARP request message, it will The communication peer sends a corresponding ARP response message, and the sender IP address (such as arp_spa, sender protocol address in the ARP response message) is the IP address of the VF that is previously allocated by the target virtual slave 620.
  • the sender MAC address (such as the arp_sha field in the ARP response message, the sender hardware address) and the Ethernet source address (the ether_shost field in the ARP response message) are the virtual MAC addresses of the VFs that are previously allocated by the target virtual slave 620.
  • the communication peer sends an IP data packet to the target virtual sub-machine 620 according to the sender IP address and the sender MAC address (or the Ethernet source address) in the ARP response message, due to the VF under the architecture.
  • Directly passing through the target virtual slave 620 causes a problem that the host 610 side cannot perform packet filtering, QoS (Quality of Service), and the like on the IP packets transmitted to the virtual slave.
  • QoS Quality of Service
  • the virtual machine communication configuration module 630 in the embodiment of the present invention sends an ARP response message to the communication peer, where the sender MAC address or the Ethernet source address in the ARP response message is the target virtual slave 620.
  • the corresponding host 610 specifies the MAC address of the network port, that is, the MAC address corresponding to the VF of the target virtual sub-machine 620 in the ARP response message that should be answered, and the MAC address of the designated network port of the host 610, so that the communication peer
  • the IP data packet may be sent to the designated network port of the host 610 corresponding to the target virtual sub-machine 620 according to the ARP response message, and may be corresponding to the target virtual sub-machine 620.
  • the host 610 After receiving the IP data sent by the communication peer end, the host 610 performs packet filtering and QoS management on the network port, and then forwards the network data that has undergone packet filtering and QoS management to the VF of the target virtual sub-machine 620. Packet filtering and QoS management can be performed on the network data sent to the target virtual sub-machine 620 on the host 610 side.
  • the virtual machine communication configuration module 630 sends the IP data packet of the target virtual sub-machine to the designated network port of the corresponding host through the APR response mode, which is only an optional embodiment of the present invention.
  • other methods may be used, for example, the destination MAC address of the IP address of the communication partner is manually configured as the designated network port of the corresponding host, or the IP address of the virtual sub-machine and the corresponding host designated network port are propagated in the network.
  • the mapping relationship of the MAC address can be achieved by letting the communication peer know that the target virtual slave corresponds to the MAC address of the designated network port of the host.
  • the IP data packet of the virtual sub-node transferred by the host designated network port in the embodiment of the present invention is implemented by configuring the MAC address, it is no longer necessary to perform the back-end drive processing on the host side to avoid generating the main The CPU performance bottleneck on the machine side or its impact on the service life, fully realize the processing power of the network card.
  • the virtual machine data flow management system may also include a host 610 and a target virtual guest 620 as shown in FIG. 6, wherein:
  • the target virtual sub-machine 620 is configured to send an IP data packet by using a virtual connection function of the SR-IOV network card, where the target MAC address and the target IP address in the IP data packet are respectively the host corresponding to the target virtual sub-machine 620. 610 the MAC address of the designated network port in the same SR-IOV network card and the IP address of the communication peer;
  • the virtual machine data flow management system in the embodiment of the present invention is based on L2 (Layer 2, data link layer) switching logic in a network card supporting SR-IOV technology, and the SR-IOV technology network card communication architecture may be as shown in the figure.
  • the VF can be generated and allocated to the target virtual sub-machine 620 through the PF of the network card of the host 610 in FIG. 3, and the IP and virtual MAC addresses of the VF are allocated, and the obtained VF pass-through target virtual sub-machine 620 is allocated.
  • the designated network port of the host 610 is the PF to which the VF of the target virtual sub-machine 620 belongs in the embodiment, or another VF that belongs to the same PF as the VF of the target virtual sub-machine 620.
  • the target IP address of the IP data packet is the IP address of the target communication peer end
  • the target MAC address is the host SR 610 corresponding to the target virtual child machine 620 is in the same SR-IOV.
  • the host 610 is configured to forward the IP data packet to the communication peer end according to the target IP address after receiving the IP data packet through a designated network port in the SR-IOV network card.
  • the host 610 can perform packet filtering and QoS management on the network port, and then forward the network data that has undergone packet filtering and QoS management to the communication peer. Therefore, packet filtering and QoS management can be performed on the network data sent by the target virtual sub-machine 620 on the host 610 side.
  • the target MAC address is set as the MAC address of the designated network port of the host 610 corresponding to the virtual sub-machine, and the virtual machine data of the present invention.
  • the flow management system can also include:
  • the virtual machine communication configuration module 630 is configured to detect that the target virtual child machine 620 sends an ARP request. And sending an ARP response message to the target virtual sub-machine 620 according to the ARP request message, where the sender MAC address or the Ethernet source address in the ARP response message is the designated network port of the host 610 corresponding to the target virtual sub-machine 620.
  • the MAC address is sent to the target virtual sub-machine 620 to send the IP data packet to the designated network port of the host 610 corresponding to the target virtual sub-machine 620 according to the ARP response message.
  • the target virtual sub-machine 620 in this embodiment is allocated in advance to obtain the IP and virtual MAC address of the VF, and the network data that the target virtual sub-machine 620 sends out through the VF.
  • the sender IP address of the ARP request message (such as arp_spa, sender protocol address in the ARP request message) and the sender MAC address (such as in the ARP request message) Arp_sha, sender hardware address) is the IP address and virtual MAC address of the VF that is allocated in advance by the target virtual slave 620.
  • the target IP address (such as arp_tpa, target protocol address in the ARP request message) is the IP address of the target communication peer.
  • the virtual machine communication configuration module 630 can confirm that the second ARP request message is sent by the target virtual slave 620 according to the sender IP address and/or the sender MAC address in the ARP request.
  • the virtual machine communication configuration module 630 can be implemented in the target virtual sub-machine 620 or in the host 610. If the virtual machine communication configuration module 630 is implemented in the target virtual child machine 620, and the target virtual child machine 620 sends an ARP request message, that is, an ARP request message, the virtual machine communication configuration module 630 can learn and virtualize The machine communication configuration module 630 can discard the ARP request message, that is, the virtual machine communication configuration module 630 intercepts and blocks the target virtual sub-machine from sending an ARP request message; if the virtual machine communication configuration module 630 is implemented in the target virtual sub-machine In the host 610 corresponding to 620, since the ARP request message is broadcast, the host 610 side actually receives the ARP request first, but in general, the host 610 side may be because the target IP address in the ARP request message is not on the host 610 side.
  • the IP address is discarded, and the virtual machine communication configuration module 630 on the host 610 side can detect whether the sender IP address and/or the sender MAC address in the received ARP request is the IP address of the target virtual slave 620 and / or MAC address, if so, it is confirmed that the ARP request message sent by the target virtual sub-machine 620 is obtained.
  • the target virtual sub-machine 620 After the ARP request message is sent, the target virtual sub-machine 620 in the prior art receives the sender MAC address or the Ethernet source address carried in the ARP response message returned by the communication peer end, which is the MAC address of the communication peer end. Then, it can send an IP to the communication peer based on its MAC address. Data, due to the Vport of the VF pass-through physical network card under the SR-IOV technology network card communication architecture, that is, the IP data sent by the target virtual sub-machine 620 through the VF can be directly sent out through the Vport, so that the target virtual side can be generated on the host 610 side.
  • the IP packet sent by the machine 620 performs packet filtering, QoS (Quality of Service), and the like.
  • the virtual machine communication configuration module 630 in the embodiment of the present invention sends an ARP response message to the target virtual sub-machine 620, where the sender MAC address or the Ethernet source address in the ARP response message is the target virtual sub-machine 620.
  • the host 610 specifies the MAC address of the network port, that is, spoofs an ARP response message, and replaces the actual MAC address of the communication peer corresponding to the destination IP address in the ARP request message sent by the target virtual slave 620 with the MAC of the designated network port of the host 610.
  • the target virtual sub-machine 620 may send an IP data packet to the designated network port of the host 610 corresponding to the target virtual sub-machine 620 according to the ARP response message, so that The host 610 corresponding to the target virtual sub-machine 620 receives the IP data sent by the target virtual sub-machine 620 through the designated network port, performs packet filtering and QoS management, and then performs packet filtering and QoS-managed network data. The packet is sent to the communication peer end, so that packet filtering and QoS management can be performed on the network data sent by the target virtual sub-machine 620 on the host 610 side.
  • the APR response mode is used to enable the target virtual sub-machine 620 to send the outgoing IP data packet to the designated network port of the corresponding host 610, which is only an optional embodiment of the present invention.
  • the target virtual sub-machine 620 can configure the destination MAC address of the IP data packet to be the designated network port of the corresponding host 610 in the driver configuration, and the same can be achieved.
  • the host 610 in the embodiment of the present invention specifies that the IP data packet of the virtual sub-network in the network port is implemented by configuring the MAC address, and the back-end driver processing on the host 610 side is no longer needed to avoid the CPU performance on the host 610 side.
  • the bottleneck or its impact on the service life, fully realize the processing power of the network card.
  • an embodiment of the present invention further provides a server, which may include components such as a processor 710, a memory 720, a communication unit 730, and the like. These components communicate over one or more buses. It will be understood by those skilled in the art that the structure of the server shown in FIG. 7 does not constitute a limitation of the present invention. It may be a bus-shaped structure or a star-shaped structure, and may also include more structures than those shown in FIG. More or less parts, or some parts, or different parts.
  • the processor 710 is a control center of the server that connects various parts of the entire server using various interfaces and lines, by running or executing program code and/or modules stored in the memory 720, and calling stored in the memory. Data within 720 to perform various functions of the server and/or process data.
  • the memory 720 can be used to store program code and modules, and the processor 710 executes various functional applications of the server and implements data processing by running program code and modules stored in the memory 720.
  • the memory 720 mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, program code required for at least one function, such as program code for performing business processing; and the data storage area can be stored according to the use of the server. The data created.
  • the communication unit 730 is configured to establish a communication channel, and the server is connected to the communication peer through the communication channel.
  • the processor 710 can call the program code stored in the memory 720 for performing the following operations:
  • the processor 710 may invoke the program code stored in the memory 720 to perform the following operations before receiving the IP data sent by the communication peer by the designated network port:
  • the peer sends the IP data packet to the designated network port of the host corresponding to the target virtual sub-machine according to the ARP response message.
  • the host designated network port is a physical connection function to which the virtual connection function of the target virtual sub-machine belongs, or another physical connection function corresponding to the virtual connection function of the target virtual sub-machine A virtual connection function.
  • the processor 710 may invoke program code stored in the memory 720 for performing the following operations:
  • the IP data packet is sent by the virtual connection function of the SR-IOV network card, where the target MAC address and the destination IP address in the IP data packet are respectively the MAC of the designated network port of the host corresponding to the target virtual sub-machine in the same SR-IOV network card. Address and IP address of the opposite end of the communication;
  • the processor 710 may call the program code stored in the memory 720 to perform the following operations before sending the IP data packet:
  • the processor 710 may invoke the program code stored in the memory 720 to perform the following operations:
  • the ARP request message is discarded.
  • the designated network port of the host corresponding to the target virtual sub-machine is a physical connection function to which the virtual connection function of the target virtual sub-machine belongs, or belongs to the same physical connection function as the virtual connection function of the target virtual sub-machine. Another virtual connection feature.
  • the MAC address of the designated network port of the virtual sub-machine corresponding to the host is configured in the IP data packet flowing through the virtual sub-machine, so that the network data of the target virtual sub-machine can be designated by the host network port, thereby achieving the target.
  • the network data of the virtual sub-machine performs packet filtering and QoS management.
  • the CPU performance bottleneck of the host side is avoided or the service life is affected, and the processing of the network card is fully realized. ability.
  • the machine can be read into a storage medium, and when executed, the program can include the flow of an embodiment of the methods as described above.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种虚拟机数据流管理方法，所述方法包括：主机通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机的指定网口的MAC地址和目标虚拟子机的IP地址；所述主机根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。本发明实施例还公开了一种虚拟机数据流管理系统。采用本发明，可提高虚拟机的网络通信性能。

Description

一种虚拟机数据流管理方法和系统
本发明要求2015年5月19日递交的发明名称为“一种虚拟机数据流管理方法和系统”的申请号201510256498.2的在先申请优先权，上述在先申请的内容以引入的方式并入本文中。
技术领域
本发明涉及计算机技术领域，尤其涉及一种虚拟机数据流管理方法和系统。
背景技术
服务器虚拟化技术，使CPU、内存、磁盘、I/O(input/output，输入输出端口)等硬件变成可以动态管理的“资源池”，从而提高资源的利用率，让计算机系统对业务的变化更具适应力。目前虚拟化技术中，虚拟子机与主机之间的网络通信采用PV驱动(Para-Virtualization Driver，半虚拟化驱动)的半虚拟化方案，即：在主机侧安装后端驱动，而在虚拟子机侧安装前端驱动，通过前后端驱动的交互来实现虚拟子机的网络通信，所有发送到虚拟子机或由虚拟子机发送的数据包都会通过主机侧的后端驱动，这样就可以在主机侧对虚拟子机的网络通信进行包过滤、QoS(Quality of Service，服务质量)等管理。但是，同时由于所有虚拟子机的数据包都会经由主机侧的后端驱动处理，即由主机侧的后端驱动进行软路由，导致主机侧的CPU处理负担非常大，使用千兆网卡时，网络吞吐量，CPU的消耗还可以接受。在使用万兆网卡时，容易主机侧的CPU性能瓶颈并且对其使用寿命产生影响，无法充分利用网卡的处理能力。
发明内容
本发明实施例所要解决的技术问题在于，提供一种虚拟机数据流管理方法和系统，可提高虚拟机的网络通信性能。
为了解决上述技术问题，本发明实施例提供了一种虚拟机数据流管理方法，所述方法包括：
主机通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机的指定网口的MAC地址和目标虚拟子机的IP地址；
所述主机根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。
相应地，本发明实施例还提供了一种虚拟机数据流管理方法，所述方法包括：
目标虚拟子机通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址；
所述主机在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
相应地，本发明实施例还提供了一种虚拟机数据流管理系统，包括主机和至少一个虚拟子机，其中：
所述主机，用于通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机的指定网口的MAC地址和目标虚拟子机的IP地址；
所述主机，还用于根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。
相应地，本发明实施例还提供了一种虚拟机数据流管理系统，包括主机和至少一个虚拟子机，其中：
所述虚拟子机，用于通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址；
所述主机，用于在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
本发明实施例中通过在流经虚拟子机的IP数据包中配置虚拟子机对应主机的指定网口的MAC地址，使得目标虚拟子机的网络数据可以经由主机指定 网口，从而可以实现对目标虚拟子机的网络数据进行包过滤、QoS管理，同时由于数据不再需要经过主机侧的后端驱动处理，避免产生主机侧的CPU性能瓶颈或对其使用寿命产生影响，充分实现利用网卡的处理能力。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例中的一种虚拟机数据流管理方法的流程示意图；
图2是本发明另一实施例中的虚拟机数据流管理方法的流程示意图；
图3是本发明实施例中的SR-IOV技术网卡通信架构的示意图；
图4是本发明另一实施例中的虚拟机数据流管理方法的流程示意图；
图5是本发明另一实施例中的虚拟机数据流管理方法的流程示意图；
图6是本发明实施例中的一种虚拟机数据流管理系统的结构示意图。
图7是本发明实施例提供的服务器的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1是本发明实施例中的一种虚拟机数据流管理方法的流程示意图，如图所示本实施例中的虚拟机数据流管理方法流程可以包括：
S101，主机通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机的指定网口的MAC地址和目标虚拟子机的IP地址。
所述主机的指定网口为本实施例中的目标虚拟子机的虚拟连接功能(下文也称VF，Virtual Function)所属的物理连接功能(下文也称PF，Physical  Funtion)，或与所述目标虚拟子机的虚拟连接功能VF属于同一物理连接功能PF的另一虚拟连接功能VF。本发明实施例中通信对端在向同属于一SR-IOV网卡的虚拟子机发送IP数据包时，IP数据包中的目标MAC地址是该虚拟子机对应的主机的指定网口的MAC地址，这样主机侧可以通过SR-IOV网卡的指定网口接收到通信对端发送的IP数据包。所述通信对端为外部网络设备，即除了主机外的其他网络设备。
S102，所述主机根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。
具体实现中，本发明实施例中的虚拟机数据流管理方法基于支持SR-IOV(Single-Root I/O Virtualization，单根I/O虚拟化)技术的网卡中的L2(Layer2，即数据链路层)交换逻辑，SR-IOV技术网卡通信架构可以如图3所示，在本实施例中的流程执行之前，可以通过图3中主机的网卡的物理连接功能(下文也称PF，Physical Funtion)为目标虚拟子机生成并分配虚拟连接功能(下文也称VF，Virtual Function)，同时分配该VF的IP和虚拟MAC地址，分配得到的VF直通目标虚拟子机。本发明实施例中的主机会管理各个虚拟子机的VF与其IP之间的映射关系，在接收到外部发来的IP数据包时，可以根据其携带的目标IP地址将所述IP数据包转发至对应的目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能，目标虚拟子机从而接收到该IP数据包。
从而，主机通过指定网口接收到通信对端发送的IP数据后可以对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至目标虚拟子机的VF，从而实现了在主机侧可以对发往目标虚拟子机的网络数据进行包过滤、QoS管理。
进而在可选实施例中，为了让通信对端在向目标虚拟子机发送IP数据包时将目标MAC地址设为该虚拟子机对应的主机的指定网口的MAC地址，本发明实施例中可以通过执行以下流程110)和120)实现这一目的：
110)，获取通信对端发送的针对所述目标虚拟子机的ARP请求消息，所述ARP请求消息中的目标IP地址为所述目标虚拟子机的IP地址。
具体的，当检测到物理网卡从外部接收到的ARP请求中的目标IP地址(如ARP请求消息中的arp_tpa，target protocol address)为所述目标虚拟子机的IP 地址时，即确认获取到通信对端发送的针对目标虚拟子机的ARP请求消息，执行120)。
执行步骤110)和120)的可以为本发明实施例中的虚拟机通信配置模块，所述虚拟机通信配置模块可以实现在目标虚拟子机中，也可以实现在主机中。若所述虚拟机通信配置模块实现在所述目标虚拟子机中，目标虚拟子机接收到针对目标虚拟子机的ARP请求消息时即所述虚拟机通信配置模块接收到针对目标虚拟子机的ARP请求消息；若实现在所述目标虚拟子机对应的主机中，由于ARP请求消息是广播的，主机侧实际也会接收到该ARP请求，只是一般情况下主机侧会因为该ARP请求消息中的目标IP地址不是主机侧的IP地址则丢弃掉，主机侧的虚拟机通信配置模块可以通过检测到物理网卡从外部接收到的ARP请求中的目标IP地址是否为所述目标虚拟子机的IP地址，若是，即确认获取到通信对端发送的针对目标虚拟子机的ARP请求消息。
120)，根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机指定网口的MAC地址，以使所述通信对端根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机的指定网口。
具体的，现有技术中所述目标虚拟子机在接收到所述ARP请求消息时，会向所述通信对端发送对应的ARP响应消息，该ARP响应消息中的发送者IP地址(如ARP响应消息中的arp_spa，sender protocol address)为目标虚拟子机预先被分配得到的VF的IP地址，发送者MAC地址(如ARP响应消息中的arp_sha字段，sender hardware address)和以太网源地址(ARP响应消息中的ether_shost字段)为目标虚拟子机预先被分配得到的VF的虚拟MAC地址，这样所述通信对端就会根据该ARP响应消息中的发送者IP地址以及发送者MAC地址(或以太网源地址)向所述目标虚拟子机发送IP数据包，由于该架构下的VF直通目标虚拟子机，这样会产生主机侧无法对发送至虚拟子机的IP数据包进行包过滤、QoS(Quality of Service，服务质量)等管理的问题。
从而，本发明实施例中的虚拟机通信配置模块通过向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为所述目标虚拟子机对应的主机指定网口的MAC地址，即将原本应该应答的 ARP响应消息中的目标虚拟子机的VF对应的MAC地址替换成主机指定网口的MAC地址，以使所述通信对端在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口，后续可以由所述目标虚拟子机对应的主机通过指定网口接收到通信对端发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至目标虚拟子机的VF，从而实现了在主机侧可以对发往目标虚拟子机的网络数据进行包过滤、QoS管理。
需要指出的是，上述通过APR响应方式让通信对端将目标虚拟子机的IP数据包发向对应主机的指定网口，仅是本发明可选实施例，在其他可选实施例中，也可以采用其他方式，例如通信对端侧手动配置IP数据包的目标MAC地址为对应主机的指定网口，或通过在网络中传播虚拟子机的IP与其对应主机指定网口的MAC地址的映射关系的方式，让通信对端得知目标虚拟子机对应主机指定网口的MAC地址，均可以实现该目的。
进而由于本发明实施例中的主机指定网口中转虚拟子机的IP数据包是通过配置MAC地址实现的，不再需要经过主机侧的后端驱动处理，避免产生主机侧的CPU性能瓶颈或对其使用寿命产生影响，充分实现利用网卡的处理能力。
图2是本发明另一实施例中的虚拟机数据流管理方法的流程示意图，如图所示本实施例中的虚拟机数据流管理方法流程可以包括：
S201，目标虚拟子机通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址。
具体的，本实施例中的目标虚拟子机与前文实施例中类似，预先被分配得到VF的IP和虚拟MAC地址，分配得到的VF直通目标虚拟子机，目标虚拟子机通过该VF向外发送网络数据。所述主机的指定网口为本实施例中的目标虚拟子机的VF所属的PF或与所述目标虚拟子机的VF属于同一PF的另一VF。目标虚拟子机向外发送IP数据包时，所述IP数据包的目标IP地址为目 标通信对端的IP地址，目标MAC地址为所述目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址，这样主机侧可以通过SR-IOV网卡的指定网口接收到目标虚拟子机向外发送的IP数据包。
S202，所述主机在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
从而，主机通过指定网口接收到目标虚拟子机通过VF发送的IP数据后可以对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至通信对端，从而实现了在主机侧可以对目标虚拟子机向外发送的网络数据进行包过滤、QoS管理。
进而在可选实施例中，为了让目标虚拟子机向外发送IP数据包时将目标MAC地址设为该虚拟子机对应的主机的指定网口的MAC地址，本发明实施例中还可以通过执行以下步骤210)和220)实现这一目的：
210)检测到目标虚拟子机发送ARP请求消息。
具体的，本实施例中的目标虚拟子机与前文实施例中类似，预先被分配得到VF的IP和虚拟MAC地址，分配得到的VF直通目标虚拟子机，目标虚拟子机通过该VF向外发送的网络数据。目标虚拟子机向外发送所述ARP请求消息时，所述ARP请求消息的发送者IP地址(如ARP请求消息中的arp_spa，sender protocol address)和发送者MAC地址(如ARP请求消息中的arp_sha，sender hardware address)为目标虚拟子机预先被分配得到的VF的IP地址和虚拟MAC地址，目标IP地址(如ARP请求消息中的arp_tpa，target protocol address)为目标通信对端的IP地址。可以根据ARP请求中的发送者IP地址和/或发送者MAC地址确认第二所述ARP请求消息是目标虚拟子机发送的。
执行步骤210)和220)的可以为本发明实施例中的虚拟机通信配置模块，所述虚拟机通信配置模块可以实现在目标虚拟子机中，也可以实现在主机中。若所述虚拟机通信配置模块实现在所述目标虚拟子机中，目标虚拟子机在需要外发送ARP请求消息，即ARP请求消息时，虚拟机通信配置模块可以获知；若所述虚拟机通信配置模块实现在所述目标虚拟子机对应的主机中，由于ARP请求消息是广播的，主机侧实际会首先接收到该ARP请求，只是一般情况下主机侧会因为该ARP请求消息中的目标IP地址不是主机侧的IP地址则丢弃 掉，主机侧的虚拟机通信配置模块可以通过检测接收到的ARP请求中的发送者IP地址和/或发送者MAC地址是否为所述目标虚拟子机的IP地址和/或MAC地址，若是，即确认获取到目标虚拟子机发送的ARP请求消息。
220)，根据所述ARP请求消息向所述目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为目标虚拟子机对应的主机指定网口的MAC地址，以使所述目标虚拟子机根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口。
具体的，现有技术中所述目标虚拟子机在发送所述ARP请求消息后，接收到通信对端返回的ARP响应消息中携带的发送者MAC地址或以太网源地址是该通信对端的MAC地址，然后可以根据该通信对端的MAC地址向其发送IP数据，由于SR-IOV技术网卡通信架构下的VF直通物理网卡的Vport，即目标虚拟子机通过VF发送的IP数据通过Vport直接可以向外发送，这样会产生主机侧无法对目标虚拟子机向外发送的IP数据包进行包过滤、QoS(Quality of Service，服务质量)等管理的问题。
从而，本发明实施例中的虚拟机通信配置模块通过向目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为目标虚拟子机对应的主机指定网口的MAC地址，即伪造一个ARP响应消息，将原本目标虚拟子机发送的ARP请求消息中的目标IP地址对应的通信对端的实际MAC地址替换成主机指定网口的MAC地址，以使目标虚拟子机在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口，从而可以由所述目标虚拟子机对应的主机通过指定网口接收到目标虚拟子机后续发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据向外发送至通信对端，从而实现了在主机侧可以对目标虚拟子机向外发送的网络数据进行包过滤、QoS管理。
需要指出的是，上述通过APR响应方式让目标虚拟子机将向外发送的IP数据包发向对应主机的指定网口，仅是本发明可选实施例，在其他可选实施例中，也可以采用其他方式，例如目标虚拟子机在驱动配置中配置IP数据包的目标MAC地址为对应主机的指定网口，同样可以实现该目的。
进而由于本发明实施例中的主机指定网口中转虚拟子机的IP数据包是通过配置MAC地址实现的，不再需要经过主机侧的后端驱动处理，避免产生主机侧的CPU性能瓶颈或对其使用寿命产生影响，充分实现利用网卡的处理能力。
图4是本发明另一实施例中的虚拟机数据流管理方法的流程示意图，本实施例重点介绍虚拟机通信配置模块如何通过配置MAC地址以实现由主机指定网口对经过目标虚拟子机的网络数据进行中转，本实施例中的虚拟机通信配置模块实现在目标虚拟子机内部，如图所示本实施例中的虚拟机数据流管理方法流程包括：
S401，主机通过SR-IOV网卡的物理连接功能PF为目标虚拟子机分配虚拟连接功能VF，同时分配该VF的IP和虚拟MAC地址，分配得到的VF直通目标虚拟子机。
S402，虚拟机通信配置模块获取通信对端发送的针对目标虚拟子机的ARP请求消息。
本实施例中的虚拟机通信配置模块实现在目标虚拟子机内部，目标虚拟子机接收到针对目标虚拟子机的ARP请求消息时即所述虚拟机通信配置模块接收到针对目标虚拟子机的ARP请求消息。
S403，虚拟机通信配置模块根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为所述目标虚拟子机对应的主机指定网口的MAC地址。
即将原本应该应答的ARP响应消息中的目标虚拟子机的VF对应的MAC地址替换成主机指定网口的MAC地址，以使所述通信对端在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口。后续可以由所述目标虚拟子机对应的主机通过指定网口接收到通信对端发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至目标虚拟子机的VF，从而实现了在主机侧可以对发往目标虚拟子机的网络数据进行包过滤、QoS管理。
所述目标虚拟子机对应的主机指定网口为所述目标虚拟子机的虚拟连接 功能VF所属的物理连接功能PF，或与所述目标虚拟子机的虚拟连接功能VF属于同一物理连接功能PF的另一虚拟连接功能VF。
S404，检测到所述目标虚拟子机发送ARP请求消息。
本实施例中的虚拟机通信配置模块实现在目标虚拟子机内部，可以检测目标虚拟子机的VF根据操作系统的指令需要发送ARP请求消息。
S405，丢弃所述ARP请求消息。
即虚拟机通信配置模块拦截并阻止目标虚拟子机向外发送ARP请求消息。
S406，根据所述ARP请求消息向所述目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为目标虚拟子机对应的主机指定网口的MAC地址。
即虚拟机通信配置模块通过伪造一个ARP响应消息，将原本目标虚拟子机发送的ARP请求消息中的目标IP地址对应的通信对端的实际MAC地址替换成主机指定网口的MAC地址，以使目标虚拟子机在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口，并由所述目标虚拟子机对应的主机通过指定网口接收到目标虚拟子机后续发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据向外发送至通信对端，从而实现了在主机侧可以对目标虚拟子机向外发送的网络数据进行包过滤、QoS管理。所述目标虚拟子机对应的主机指定网口为所述目标虚拟子机的虚拟连接功能VF所属的物理连接功能PF，或与所述目标虚拟子机的虚拟连接功能VF属于同一物理连接功能PF的另一虚拟连接功能VF。
S407，检测到所述目标虚拟子机迁移完成后，获取迁移后主机指定网口的MAC地址。
具体实现中，在SR-IOV技术网卡通信架构下的目标虚拟子机热迁移过程中，需要热拔掉虚拟子机使用的VF对应的网卡，然后在虚拟子机迁移完成后，通过SR-IOV技术网卡通信架构下VF之间以及VF和所属PF之间的通信机制，虚拟机通信配置模块可以获取到目标虚拟子机热迁移后所对应的主机指定网口的MAC地址，以便后续在执行S401-403以及S404-406时，可以实现对从 外部发往目标虚拟子机的网络数据，以及对目标虚拟子机向外发送的网络数据进行包过滤、QoS管理。
图5是本发明另一实施例中的虚拟机数据流管理方法的流程示意图，本实施例重点介绍虚拟机通信配置模块如何通过配置MAC地址以实现由主机指定网口对经过目标虚拟子机的网络数据进行中转，本实施例中的虚拟机通信配置模块实现在目标虚拟子机对应主机侧，如图所示本实施例中的虚拟机数据流管理方法流程包括：
S501，主机通过SR-IOV网卡的物理连接功能PF为目标虚拟子机分配虚拟连接功能VF，同时分配该VF的IP和虚拟MAC地址，分配得到的VF直通目标虚拟子机。
S502，虚拟机通信配置模块获取通信对端发送的针对目标虚拟子机的ARP请求消息。
本实施例中的虚拟机通信配置模块实现在所述目标虚拟子机对应的主机中，由于ARP请求消息是广播的，主机侧实际也会接收到该ARP请求，只是一般情况下主机侧会因为该ARP请求消息中的目标IP地址不是主机侧的IP地址则丢弃掉，本发明实施例中主机侧的虚拟机通信配置模块可以通过检测到物理网卡从外部接收到的ARP请求中的目标IP地址是否为所述目标虚拟子机的IP地址，若是，即确认获取到通信对端发送的针对目标虚拟子机的ARP请求消息。
S503，虚拟机通信配置模块根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为指定网口的MAC地址。
本实施例中，约定目标虚拟子机不对外部发送的ARP请求消息进行响应，由虚拟机通信配置模块向外部的通信对端发送ARP响应消息，并且将原本应该应答的ARP响应消息中的目标虚拟子机的VF对应的MAC地址替换成主机指定网口的MAC地址，以使所述通信对端在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口，并在可选实施例中可以由所述目标虚拟子机对应的主机通过指定网 口接收到通信对端发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至目标虚拟子机的VF，从而实现了在主机侧可以对发往目标虚拟子机的网络数据进行包过滤、QoS管理。所述目标虚拟子机对应的主机指定网口为所述目标虚拟子机的虚拟连接功能VF所属的物理连接功能PF，或与所述目标虚拟子机的虚拟连接功能VF属于同一物理连接功能PF的另一虚拟连接功能VF。
S504，确定接收到的ARP请求消息中的发送者IP地址为所述目标虚拟子机的IP地址。
本实施例中虚拟机通信配置模块实现在目标虚拟子机对应的主机侧，由于ARP请求消息是广播的，主机侧实际会首先接收到该ARP请求，只是一般情况下主机侧会因为该ARP请求消息中的目标IP地址不是主机侧的IP地址则丢弃掉，本发明实施例中主机侧的虚拟机通信配置模块可以通过检测接收到的ARP请求中的发送者IP地址和/或发送者MAC地址是否为所述目标虚拟子机的IP地址和/或MAC地址，若是，即确认获取到目标虚拟子机发送的ARP请求消息。
S505，根据所述ARP请求消息向所述目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为指定网口的MAC地址，以使所述目标虚拟子机根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口。
即虚拟机通信配置模块拦截并阻止目标虚拟子机向外发送ARP请求消息，并伪造一个ARP响应消息，该ARP响应消息中的发送者MAC地址或以太网源地址由原本目标虚拟子机发送的ARP请求消息中的目标IP地址对应的通信对端的实际MAC地址替换成主机指定网口的MAC地址，以使目标虚拟子机在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机指定网口，并在可选实施例中可以由所述目标虚拟子机对应的主机通过指定网口接收到目标虚拟子机后续发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据向外发送至通信对端，从而实现了在主机侧可以对目标虚拟子机向外发送的网络数据进行包过滤、QoS管理。
S506，检测到目标虚拟子机迁移完成后，获取迁移后目标虚拟子机的虚拟功能网口的MAC地址。
具体实现中，在SR-IOV技术网卡通信架构下的目标虚拟子机热迁移过程中，需要热拔掉虚拟子机使用的VF对应的网卡，然后在虚拟子机迁移完成后，通过SR-IOV技术网卡通信架构下VF之间以及VF和所属PF之间的通信机制，虚拟机通信配置模块可以获取到目标虚拟子机热迁移后分配得到的VF的MAC地址，以便后续在执行S501-503以及S504-505时，可以实现对从外部发往目标虚拟子机的网络数据，以及对目标虚拟子机向外发送的网络数据进行包过滤、QoS管理。
图6是本发明实施例中的一种虚拟机数据流管理系统的结构示意图，如图所示本发明实施例中的虚拟机数据流管理系统可以包括主机610和目标虚拟子机620，其中：
所述主机610，用于通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机610的指定网口的MAC地址和目标虚拟子机620的IP地址。
具体实现中，本发明实施例中的虚拟机数据流管理系统基于支持SR-IOV(Single-Root I/O Virtualization，单根I/O虚拟化)技术的网卡中的L2(Layer 2，即数据链路层)交换逻辑，SR-IOV技术网卡通信架构可以如图3所示，可以通过图3中主机610的网卡的PF为目标虚拟子机620生成并分配VF，同时分配该VF的IP和虚拟MAC地址，分配得到的VF直通目标虚拟子机。所述主机610的指定网口为本实施例中的目标虚拟子机620的VF所属的PF，或与所述目标虚拟子机620的VF属于同一PF的另一VF。本发明实施例中通信对端在向同属于一SR-IOV网卡的目标虚拟子机620发送IP数据包时，IP数据包中的目标MAC地址是该目标虚拟子机620对应的主机610的指定网口的MAC地址，这样主机610可以通过SR-IOV网卡的指定网口接收到通信对端发送的IP数据包。所述通信对端为外部网络设备，即除了主机610外的其他网络设备。
所述主机，还用于根据所述目标IP地址将所述IP数据包转发至目标虚拟 子机在相同SR-IOV网卡中的虚拟连接功能。
本发明实施例中的主机会管理各个虚拟子机的VF与其IP之间的映射关系，在接收到外部发来的IP数据包时，可以根据其携带的目标IP地址将所述IP数据包转发至对应的目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能，目标虚拟子机从而接收到该IP数据包。
从而，主机通过指定网口接收到通信对端发送的IP数据后可以对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至目标虚拟子机的VF，从而实现了在主机侧可以对发往目标虚拟子机的网络数据进行包过滤、QoS管理。
进而在可选实施例中，为了让通信对端在向目标虚拟子机620发送IP数据包时将目标MAC地址设为目标虚拟子机620对应的主机610的指定网口的MAC地址，本发明的虚拟机数据流管理系统还可以包括：
虚拟机通信配置模块630，用于获取通信对端发送的针对所述目标虚拟子机620的ARP请求消息，所述ARP请求消息中的目标IP地址为所述目标虚拟子机620的IP地址；根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机610指定网口的MAC地址，以使所述通信对端根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机620对应的主机610的指定网口。
具体实现中，所述虚拟机通信配置模块630可以实现在目标虚拟子机620中，也可以实现在主机610中。若所述虚拟机通信配置模块630实现在所述目标虚拟子机620中，目标虚拟子机620接收到针对目标虚拟子机的ARP请求消息时即所述虚拟机通信配置模块630接收到针对目标虚拟子机的ARP请求消息；若实现在所述目标虚拟子机620对应的主机610中，由于ARP请求消息是广播的，主机侧实际也会接收到该ARP请求，只是一般情况下主机610会因为该ARP请求消息中的目标IP地址不是主机侧的IP地址则丢弃掉，主机610中的虚拟机通信配置模块630可以通过检测到物理网卡从外部接收到的ARP请求中的目标IP地址是否为所述目标虚拟子机620的IP地址，若是，即确认获取到通信对端发送的针对目标虚拟子机620的ARP请求消息。
现有技术中所述目标虚拟子机620在接收到所述ARP请求消息时，会向 所述通信对端发送对应的ARP响应消息，该ARP响应消息中的发送者IP地址(如ARP响应消息中的arp_spa，sender protocol address)为目标虚拟子机620预先被分配得到的VF的IP地址，发送者MAC地址(如ARP响应消息中的arp_sha字段，sender hardware address)和以太网源地址(ARP响应消息中的ether_shost字段)为目标虚拟子机620预先被分配得到的VF的虚拟MAC地址，这样所述通信对端就会根据该ARP响应消息中的发送者IP地址以及发送者MAC地址(或以太网源地址)向所述目标虚拟子机620发送IP数据包，由于该架构下的VF直通目标虚拟子机620，这样会产生主机610侧无法对发送至虚拟子机的IP数据包进行包过滤、QoS(Quality of Service，服务质量)等管理的问题。
从而，本发明实施例中的虚拟机通信配置模块630通过向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为所述目标虚拟子机620对应的主机610指定网口的MAC地址，即将原本应该应答的ARP响应消息中的目标虚拟子机620的VF对应的MAC地址替换成主机610指定网口的MAC地址，以使所述通信对端在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机620对应的主机610指定网口，后续可以由所述目标虚拟子机620对应的主机610通过指定网口接收到通信对端发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至目标虚拟子机620的VF，从而实现了在主机610侧可以对发往目标虚拟子机620的网络数据进行包过滤、QoS管理。
需要指出的是，上述虚拟机通信配置模块630通过APR响应方式让通信对端将目标虚拟子机的IP数据包发向对应主机的指定网口，仅是本发明可选实施例，在其他可选实施例中，也可以采用其他方式，例如通信对端侧手动配置IP数据包的目标MAC地址为对应主机的指定网口，或通过在网络中传播虚拟子机的IP与其对应主机指定网口的MAC地址的映射关系的方式，让通信对端得知目标虚拟子机对应主机指定网口的MAC地址，均可以实现该目的。
进而由于本发明实施例中的主机指定网口中转虚拟子机的IP数据包是通过配置MAC地址实现的，不再需要经过主机侧的后端驱动处理，避免产生主 机侧的CPU性能瓶颈或对其使用寿命产生影响，充分实现利用网卡的处理能力。
在本发明另一实施例中，虚拟机数据流管理系统同样如图6所示可以包括主机610和目标虚拟子机620，其中：
所述目标虚拟子机620，用于通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述目标虚拟子机620对应的主机610在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址；
具体实现中，本发明实施例中的虚拟机数据流管理系统基于支持SR-IOV技术的网卡中的L2(Layer 2，即数据链路层)交换逻辑，SR-IOV技术网卡通信架构可以如图3所示，可以通过图3中主机610的网卡的PF为目标虚拟子机620生成并分配VF，同时分配该VF的IP和虚拟MAC地址，分配得到的VF直通目标虚拟子机620。所述主机610的指定网口为本实施例中的目标虚拟子机620的VF所属的PF，或与所述目标虚拟子机620的VF属于同一PF的另一VF。目标虚拟子机620向外发送IP数据包时，所述IP数据包的目标IP地址为目标通信对端的IP地址，目标MAC地址为所述目标虚拟子机620对应的主机610在相同SR-IOV网卡中的指定网口的MAC地址，这样主机610侧可以通过SR-IOV网卡的指定网口接收到目标虚拟子机620向外发送的IP数据包。
所述主机610，用于在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
从而，主机610通过指定网口接收到目标虚拟子机620通过VF发送的IP数据后可以对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据转发至通信对端，从而实现了在主机610侧可以对目标虚拟子机620向外发送的网络数据进行包过滤、QoS管理。
进而在可选实施例中，为了让目标虚拟子机620向外发送IP数据包时将目标MAC地址设为该虚拟子机对应的主机610的指定网口的MAC地址，本发明的虚拟机数据流管理系统还可以包括：
虚拟机通信配置模块630，用于检测到目标虚拟子机620发送ARP请求 消息；根据所述ARP请求消息向所述目标虚拟子机620发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为目标虚拟子机620对应的主机610指定网口的MAC地址，以使所述目标虚拟子机620根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机620对应的主机610指定网口。
具体的，本实施例中的目标虚拟子机620预先被分配得到VF的IP和虚拟MAC地址，目标虚拟子机620通过该VF向外发送的网络数据。目标虚拟子机620向外发送所述ARP请求消息时，所述ARP请求消息的发送者IP地址(如ARP请求消息中的arp_spa，sender protocol address)和发送者MAC地址(如ARP请求消息中的arp_sha，sender hardware address)为目标虚拟子机620预先被分配得到的VF的IP地址和虚拟MAC地址，目标IP地址(如ARP请求消息中的arp_tpa，target protocol address)为目标通信对端的IP地址。虚拟机通信配置模块630可以根据ARP请求中的发送者IP地址和/或发送者MAC地址确认第二所述ARP请求消息是目标虚拟子机620发送的。
所述虚拟机通信配置模块630可以实现在目标虚拟子机620中，也可以实现在主机610中。若所述虚拟机通信配置模块630实现在所述目标虚拟子机620中，目标虚拟子机620在需要外发送ARP请求消息，即ARP请求消息时，虚拟机通信配置模块630可以获知，进而虚拟机通信配置模块630可以丢弃该ARP请求消息，即虚拟机通信配置模块630拦截并阻止目标虚拟子机向外发送ARP请求消息；若所述虚拟机通信配置模块630实现在所述目标虚拟子机620对应的主机610中，由于ARP请求消息是广播的，主机610侧实际会首先接收到该ARP请求，只是一般情况下主机610侧会因为该ARP请求消息中的目标IP地址不是主机610侧的IP地址则丢弃掉，主机610侧的虚拟机通信配置模块630可以通过检测接收到的ARP请求中的发送者IP地址和/或发送者MAC地址是否为所述目标虚拟子机620的IP地址和/或MAC地址，若是，即确认获取到目标虚拟子机620发送的ARP请求消息。
现有技术中所述目标虚拟子机620在发送所述ARP请求消息后，接收到通信对端返回的ARP响应消息中携带的发送者MAC地址或以太网源地址是该通信对端的MAC地址，然后可以根据该通信对端的MAC地址向其发送IP 数据，由于SR-IOV技术网卡通信架构下的VF直通物理网卡的Vport，即目标虚拟子机620通过VF发送的IP数据通过Vport直接可以向外发送，这样会产生主机610侧无法对目标虚拟子机620向外发送的IP数据包进行包过滤、QoS(Quality of Service，服务质量)等管理的问题。
从而，本发明实施例中的虚拟机通信配置模块630通过向目标虚拟子机620发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址为目标虚拟子机620对应的主机610指定网口的MAC地址，即伪造一个ARP响应消息，将原本目标虚拟子机620发送的ARP请求消息中的目标IP地址对应的通信对端的实际MAC地址替换成主机610指定网口的MAC地址，以使目标虚拟子机620在接收到所述ARP响应消息后，可以根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机620对应的主机610指定网口，从而可以由所述目标虚拟子机620对应的主机610通过指定网口接收到目标虚拟子机620后续发送的IP数据后对其进行包过滤、QoS管理后，再将经过包过滤、QoS管理的网络数据向外发送至通信对端，从而实现了在主机610侧可以对目标虚拟子机620向外发送的网络数据进行包过滤、QoS管理。
需要指出的是，上述通过APR响应方式让目标虚拟子机620将向外发送的IP数据包发向对应主机610的指定网口，仅是本发明可选实施例，在其他可选实施例中，也可以采用其他方式，例如目标虚拟子机620在驱动配置中配置IP数据包的目标MAC地址为对应主机610的指定网口，同样可以实现该目的。
进而由于本发明实施例中的主机610指定网口中转虚拟子机的IP数据包是通过配置MAC地址实现的，不再需要经过主机610侧的后端驱动处理，避免产生主机610侧的CPU性能瓶颈或对其使用寿命产生影响，充分实现利用网卡的处理能力。
参考图7，本发明实施例还提供了一种服务器，可以包括处理器710、存储器720、通信单元730等组件。这些组件通过一条或多条总线进行通信。本领域技术人员可以理解，图7所示的服务器的结构并不构成对本发明的限定，它既可以是总线形结构，也可以是星型结构，还可以包括比图7所示的结构更 多或更少的部件，或者组合某些部件，或者不同的部件布置。
所述处理器710为服务器的控制中心，利用各种接口和线路连接整个服务器的各个部分，通过运行或执行存储在所述存储器720内的程序代码和/或模块，以及调用存储在所述存储器720内的数据，以执行服务器的各种功能和/或处理数据。
所述存储器720可用于存储程序代码以及模块，所述处理器710通过运行存储在所述存储器720的程序代码以及模块，从而执行服务器的各种功能应用以及实现数据处理。所述存储器720主要包括程序存储区和数据存储区，其中，程序存储区可存储操作系统、至少一个功能所需的程序代码，比如进行业务处理的程序代码；数据存储区可存储根据服务器的使用所创建的数据。
所述通信单元730用于建立通信道，使服务器通过通信信道以连接至通信对端。
在图7所示的服务器中，所述处理器710可以调用所述存储器720中存储的程序代码，用于执行以下操作：
通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机的指定网口的MAC地址和目标虚拟子机的IP地址；
根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。
其中，通过指定网口接收通信对端发送的IP数据之前，所述处理器710可以调用所述存储器720中存储的程序代码，用于执行以下操作：
获取通信对端发送的针对所述目标虚拟子机的ARP请求消息，所述ARP请求消息中的目标IP地址为所述目标虚拟子机的IP地址；
根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机指定网口的MAC地址，以使所述通信对端根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机的指定网口。
其中，所述主机指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另 一虚拟连接功能。
在本发明另一实施例中，所述处理器710可以调用所述存储器720中存储的程序代码，用于执行以下操作：
通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址；
在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
其中，在发送IP数据包之前，所述处理器710可以调用所述存储器720中存储的程序代码，用于执行以下操作：
发送ARP请求消息；
根据所述ARP请求消息向所述目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机的指定网口的MAC地址，以使所述目标虚拟子机根据所述ARP响应消息将IP数据包发送至所述主机的指定网口。
其中，所述检测到发送ARP请求消息之后，所述处理器710可以调用所述存储器720中存储的程序代码，用于执行以下操作：
丢弃所述ARP请求消息。
其中，所述目标虚拟子机对应的主机的指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另一虚拟连接功能。
本发明实施例通过在流经虚拟子机的IP数据包中配置虚拟子机对应主机的指定网口的MAC地址，使得目标虚拟子机的网络数据可以经由主机指定网口，从而可以实现对目标虚拟子机的网络数据进行包过滤、QoS管理，同时由于数据不再需要经过主机侧的后端驱动处理，避免产生主机侧的CPU性能瓶颈或对其使用寿命产生影响，充分实现利用网卡的处理能力。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算 机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上所揭露的仅为本发明较佳实施例而已，当然不能以此来限定本发明之权利范围，因此依本发明权利要求所作的等同变化，仍属本发明所涵盖的范围。

Claims (21)

  1. 一种虚拟机数据流管理方法，其特征在于，所述方法包括：
    主机通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机的指定网口的MAC地址和目标虚拟子机的IP地址；
    所述主机根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。
  2. 如权利要求1所述的虚拟机数据流管理方法，其特征在于，所述主机通过指定网口接收通信对端发送的IP数据之前还包括：
    获取通信对端发送的针对所述目标虚拟子机的ARP请求消息，所述ARP请求消息中的目标IP地址为所述目标虚拟子机的IP地址；
    根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机指定网口的MAC地址，以使所述通信对端根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机的指定网口。
  3. 如权利要求1-2中任一项所述的虚拟机数据流管理方法，其特征在于，所述主机指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另一虚拟连接功能。
  4. 一种虚拟机数据流管理方法，其特征在于，所述方法包括：
    目标虚拟子机通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址；
    所述主机在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
  5. 如权利要求4所述的虚拟机数据流管理方法，其特征在于，在所述目标虚拟子机发送IP数据包之前还包括：
    所述目标虚拟子机发送ARP请求消息；
    根据所述ARP请求消息向所述目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机的指定网口的MAC地址，以使所述目标虚拟子机根据所述ARP响应消息将IP数据包发送至所述主机的指定网口。
  6. 如权利要求5所述的虚拟机数据流管理方法，其特征在于，所述检测到所述目标虚拟子机发送ARP请求消息之后还包括：
    丢弃所述ARP请求消息。
  7. 如权利要求4-6中任一项所述的虚拟机数据流管理方法，其特征在于，所述目标虚拟子机对应的主机的指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另一虚拟连接功能。
  8. 一种虚拟机数据流管理系统，其特征在于，包括主机和目标虚拟子机，其中：
    所述主机，用于通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述主机的指定网口的MAC地址和目标虚拟子机的IP地址；
    所述主机，还用于根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。
  9. 如权利要求8所述的虚拟机数据流管理系统，其特征在于，所述还包括：
    虚拟机通信配置模块，用于获取通信对端发送的针对所述目标虚拟子机的 ARP请求消息，所述ARP请求消息中的目标IP地址为所述目标虚拟子机的IP地址；根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机指定网口的MAC地址，以使所述通信对端根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机的指定网口。
  10. 如权利要求8或9所述的虚拟机数据流管理系统，其特征在于，所述主机的指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另一虚拟连接功能。
  11. 一种虚拟机数据流管理系统，其特征在于，包括主机和目标虚拟子机，其中：
    所述目标虚拟子机，用于通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是所述目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址；
    所述主机，用于在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
  12. 如权利要求11所述的虚拟机数据流管理系统，其特征在于，还包括：
    虚拟机通信配置模块，用于检测到目标虚拟子机发送ARP请求消息时，根据所述ARP请求消息向所述目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机的指定网口的MAC地址，以使所述目标虚拟子机根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机的指定网口。
  13. 如权利要求12所述的虚拟机数据流管理系统，其特征在于，所述虚拟机通信配置模块还用于：
    在检测到目标虚拟子机发送ARP请求消息后，丢弃所述ARP请求消息。
  14. 如权利要求11-13中任一项所述的虚拟机数据流管理系统，其特征在于，所述目标虚拟子机对应的主机指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另一虚拟连接功能。
  15. 一种服务器，包括：
    存储器，存储程序代码；以及
    处理器，调用所述程序代码以执行以下操作：
    通过SR-IOV网卡的指定网口接收通信对端发送的IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是主机的指定网口的MAC地址和目标虚拟子机的IP地址；
    根据所述目标IP地址将所述IP数据包转发至目标虚拟子机在相同SR-IOV网卡中的虚拟连接功能。
  16. 如权利要求15所述的服务器，其特征在于，通过指定网口接收通信对端发送的IP数据之前，所述处理器，调用所述程序代码以执行以下操作：
    获取通信对端发送的针对所述目标虚拟子机的ARP请求消息，所述ARP请求消息中的目标IP地址为所述目标虚拟子机的IP地址；
    根据所述ARP请求消息向所述通信对端发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机指定网口的MAC地址，以使所述通信对端根据所述ARP响应消息将IP数据包发送至所述目标虚拟子机对应的主机的指定网口。
  17. 如权利要求15-16中任一项所述的服务器，其特征在于，所述主机指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另一虚拟连接功能。
  18. 一种服务器，包括：
    存储器，存储程序代码；以及
    处理器，调用所述程序代码以执行以下操作：
    通过SR-IOV网卡的虚拟连接功能发送IP数据包，所述IP数据包中的目标MAC地址和目标IP地址分别是目标虚拟子机对应的主机在相同SR-IOV网卡中的指定网口的MAC地址和通信对端的IP地址；
    在通过所述SR-IOV网卡中的指定网口接收到所述IP数据包后根据所述目标IP地址将所述IP数据包转发至所述通信对端。
  19. 如权利要求18所述的服务器，其特征在于，在发送IP数据包之前，所述处理器，调用所述程序代码以执行以下操作：
    发送ARP请求消息；
    根据所述ARP请求消息向所述目标虚拟子机发送ARP响应消息，所述ARP响应消息中的发送者MAC地址或以太网源地址均为所述主机的指定网口的MAC地址，以使所述目标虚拟子机根据所述ARP响应消息将IP数据包发送至所述主机的指定网口。
  20. 如权利要求19所述的服务器，其特征在于，所述检测到发送ARP请求消息之后，所述处理器，调用所述程序代码以执行以下操作：
    丢弃所述ARP请求消息。
  21. 如权利要求18-20中任一项所述的服务器，其特征在于，所述目标虚拟子机对应的主机的指定网口为所述目标虚拟子机的虚拟连接功能所属的物理连接功能，或与所述目标虚拟子机的虚拟连接功能属于同一物理连接功能的另一虚拟连接功能。
PCT/CN2016/079465 2015-05-19 2016-04-15 一种虚拟机数据流管理方法和系统 WO2016184283A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/605,505 US10348624B2 (en) 2015-05-19 2017-05-25 Virtual machine data flow management method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510256498.2A CN106302322B (zh) 2015-05-19 2015-05-19 一种虚拟机数据流管理方法和系统
CN201510256498.2 2015-05-19

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/605,505 Continuation US10348624B2 (en) 2015-05-19 2017-05-25 Virtual machine data flow management method and system

Publications (1)

Publication Number Publication Date
WO2016184283A1 true WO2016184283A1 (zh) 2016-11-24

Family

ID=57319463

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/079465 WO2016184283A1 (zh) 2015-05-19 2016-04-15 一种虚拟机数据流管理方法和系统

Country Status (3)

Country Link
US (1) US10348624B2 (zh)
CN (1) CN106302322B (zh)
WO (1) WO2016184283A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109617920A (zh) * 2019-01-23 2019-04-12 新华三信息安全技术有限公司 一种报文处理方法、装置、路由器及防火墙设备
US20200004572A1 (en) * 2018-06-28 2020-01-02 Cable Television Laboratories, Inc Systems and methods for secure network management of virtual network functions
CN114143244A (zh) * 2021-11-24 2022-03-04 新华三大数据技术有限公司 一种报文处理方法、装置、存储介质及网关设备
US11563677B1 (en) * 2018-06-28 2023-01-24 Cable Television Laboratories, Inc. Systems and methods for secure network management of virtual network function

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109739618B (zh) * 2018-12-10 2021-04-06 新华三云计算技术有限公司 虚拟机迁移方法及装置
CN110198243B (zh) * 2019-06-11 2021-11-19 深信服科技股份有限公司 一种虚拟机的网络接入方法及相关设备
US11153261B2 (en) 2020-01-22 2021-10-19 Cisco Technology, Inc. Routing traffic for virtualized/containerized network functions
CN111988230B (zh) * 2020-08-19 2023-04-07 海光信息技术股份有限公司 虚拟机通信方法、装置、系统及电子设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102946366A (zh) * 2012-11-12 2013-02-27 杭州华为数字技术有限公司 带内管理方法及系统
US8478853B2 (en) * 2009-05-29 2013-07-02 Oracle America, Inc. Handling of multiple MAC unicast addresses with virtual machines
CN104144130A (zh) * 2013-05-10 2014-11-12 中国电信股份有限公司 虚拟机系统互联的方法、系统和接入交换机

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4934642B2 (ja) * 2008-06-11 2012-05-16 株式会社日立製作所 計算機システム
US9389895B2 (en) * 2009-12-17 2016-07-12 Microsoft Technology Licensing, Llc Virtual storage target offload techniques
US8462780B2 (en) * 2011-03-30 2013-06-11 Amazon Technologies, Inc. Offload device-based stateless packet processing
CN102707991B (zh) * 2012-05-17 2016-03-30 中国科学院计算技术研究所 多根i/o虚拟化共享方法和系统
CN102722414B (zh) * 2012-05-22 2014-04-02 中国科学院计算技术研究所 用于多根i/o 虚拟化共享系统的i/o 资源管理方法
CN103049331B (zh) * 2012-12-06 2015-09-23 华中科技大学 一种虚拟功能的动态调度方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8478853B2 (en) * 2009-05-29 2013-07-02 Oracle America, Inc. Handling of multiple MAC unicast addresses with virtual machines
CN102946366A (zh) * 2012-11-12 2013-02-27 杭州华为数字技术有限公司 带内管理方法及系统
CN104144130A (zh) * 2013-05-10 2014-11-12 中国电信股份有限公司 虚拟机系统互联的方法、系统和接入交换机

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200004572A1 (en) * 2018-06-28 2020-01-02 Cable Television Laboratories, Inc Systems and methods for secure network management of virtual network functions
US11563677B1 (en) * 2018-06-28 2023-01-24 Cable Television Laboratories, Inc. Systems and methods for secure network management of virtual network function
US11822946B2 (en) * 2018-06-28 2023-11-21 Cable Television Laboratories, Inc. Systems and methods for secure network management of virtual network functions
US11855890B2 (en) 2018-06-28 2023-12-26 Cable Television Laboratories, Inc. Systems and methods for secure network management of virtual network function
CN109617920A (zh) * 2019-01-23 2019-04-12 新华三信息安全技术有限公司 一种报文处理方法、装置、路由器及防火墙设备
CN109617920B (zh) * 2019-01-23 2021-07-20 新华三信息安全技术有限公司 一种报文处理方法、装置、路由器及防火墙设备
CN114143244A (zh) * 2021-11-24 2022-03-04 新华三大数据技术有限公司 一种报文处理方法、装置、存储介质及网关设备
CN114143244B (zh) * 2021-11-24 2024-01-30 新华三大数据技术有限公司 一种报文处理方法、装置、存储介质及网关设备

Also Published As

Publication number Publication date
CN106302322A (zh) 2017-01-04
CN106302322B (zh) 2020-05-26
US10348624B2 (en) 2019-07-09
US20170279713A1 (en) 2017-09-28

Similar Documents

Publication Publication Date Title
US11923996B2 (en) Replicating broadcast, unknown-unicast, and multicast traffic in overlay logical networks bridged with physical networks
WO2016184283A1 (zh) 一种虚拟机数据流管理方法和系统
US11029982B2 (en) Configuration of logical router
US11736394B2 (en) Address resolution using multiple designated instances of a logical router
US10135635B2 (en) Encoding control plane information in transport protocol source port field and applications thereof in network virtualization
US11477131B2 (en) Distributed network address translation for efficient cloud service access
US11095513B2 (en) Scalable controller for hardware VTEPs
US9531676B2 (en) Proxy methods for suppressing broadcast traffic in a network
CA2968964C (en) Source ip address transparency systems and methods
US8358661B2 (en) Remote adapter configuration
US8571408B2 (en) Hardware accelerated data frame forwarding
US9338091B2 (en) Procedures for efficient cloud service access in a system with multiple tenant logical networks
KR20130060291A (ko) 컴퓨터 시스템 및 컴퓨터 시스템에 있어서의 통신 방법
EP3588875B1 (en) Web services across virtual routing and forwarding
KR20180025944A (ko) Sdn 기반의 arp 구현 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16795770

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11/04/2018)

122 Ep: pct application non-entry in european phase

Ref document number: 16795770

Country of ref document: EP

Kind code of ref document: A1