WO2018000195A1 - 一种报文传输方法、虚拟交换机及服务器 - Google Patents

一种报文传输方法、虚拟交换机及服务器 Download PDF

Info

Publication number
WO2018000195A1
WO2018000195A1 PCT/CN2016/087482 CN2016087482W WO2018000195A1 WO 2018000195 A1 WO2018000195 A1 WO 2018000195A1 CN 2016087482 W CN2016087482 W CN 2016087482W WO 2018000195 A1 WO2018000195 A1 WO 2018000195A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
server
virtual machine
shared memory
virtual
Prior art date
Application number
PCT/CN2016/087482
Other languages
English (en)
French (fr)
Inventor
陈文�
常波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/087482 priority Critical patent/WO2018000195A1/zh
Publication of WO2018000195A1 publication Critical patent/WO2018000195A1/zh

Links

Images

Definitions

  • the present application relates to the field of communications, and in particular, to a message transmission method, a virtual switch, and a server.
  • multiple virtual machines can be run on one server.
  • the server can be connected to other devices through physical network cards.
  • the communication between virtual machines can be realized through virtual switches running on the server. Virtual on the server. Communication between the machine and other devices outside the server can also be achieved through a virtual switch.
  • the present application provides a packet transmission method, a virtual switch, and a server, and aims to balance the security of the virtual machine and the efficiency of the message communication.
  • a first aspect of the present invention provides a packet transmission method, including the following steps: a host process of a server obtains a packet and a destination address of the packet, and if the destination address of the packet is an address of the first virtual machine, the host process The packet is copied to the first shared memory of the first virtual machine running on the server. If the destination address of the packet is different from the physical address of the server, the host process notifies the physical NIC of the server to obtain the packet and transmit the packet. It can be seen that when the packet is transmitted, the packet is sent in different manners according to the destination address of the packet: if the destination address is the address of the virtual machine running on the server, the packet is copied from the source virtual machine.
  • the security risk of the packet leakage caused by the virtual machine in the prior art by using the pointer to directly read the packet from the source virtual machine is avoided, and the memory security of the virtual machine is ensured; If the destination address is different from the physical address of the server, the physical network card is notified to directly read the packet and transmit the packet instead of copying the packet to the cache of the physical network card. This saves the packet time consumption and ensures the packet.
  • the efficiency of communication In summary, the security of the virtual machine is achieved. The purpose of the efficiency of message communication.
  • a second aspect of the present invention provides a virtual switch including the following structure:
  • the packet and address obtaining module obtains the destination address of the packet and the packet, and the address judging module judges the destination address of the packet. If the destination address of the packet is the address of the first virtual machine, the running packet replication module copies the packet. To the first shared memory of the first virtual machine running on the server, if the destination address of the packet is different from the physical address of the server, the running packet triggering module notifies the physical network card of the server to obtain the packet and transmit the packet. It can be seen that when the packet is transmitted, the virtual switch sends the packet in different manners based on the destination address of the packet. If the destination address is the address of the virtual machine running on the server, the packet is virtualized from the source.
  • the machine is copied to the shared memory of the destination virtual machine, which avoids the security risk of the packet leakage caused by the virtual machine in the prior art using the pointer to directly read the packet from the source virtual machine, thereby ensuring the security of the virtual machine memory.
  • the destination address is different from the physical address of the server, the physical network card is notified to directly read the packet and transmit the packet instead of copying the packet to the cache of the physical network card, thereby saving the time consumption of the packet copy and ensuring the report.
  • the efficiency of communication In summary, the purpose of achieving both the security of the virtual machine and the efficiency of the message communication is achieved.
  • a third aspect of the invention provides a server comprising the following structure:
  • the processor runs the application to construct a virtual switch and at least two virtual machines, wherein the virtual switch obtains packets and messages.
  • the packet is copied to the first shared memory of the first virtual machine running on the server.
  • the destination address of the packet is the physical address of the server.
  • the physical network card of the notification server obtains the message and transmits it. Therefore, when the server transmits a packet, the server sends the packet in different manners based on the destination address of the packet. If the destination address is the address of the virtual machine running on the server, the packet is sent from the source virtual machine.
  • the shared memory that is copied to the destination virtual machine avoids the security risks of the packet leakage caused by the virtual machine in the prior art by using the pointer to directly read the packet from the source virtual machine, thereby ensuring the security of the virtual machine's memory; If the destination address is different from the physical address of the server, the physical network card is notified to directly read the packet and transmit the packet instead of copying the packet to the cache of the physical network card. This saves the packet time consumption and ensures the packet.
  • the efficiency of communication In summary, the security and messaging of the virtual machine are realized. The purpose of the letter's efficiency.
  • the message is in the second shared memory or host memory before being transmitted, the second shared memory is the allocated memory for the second virtual machine access, and the second virtual machine is the virtual machine running on the server. Therefore, based on the host process, the destination address of the packet is accurately obtained, and the security of the virtual machine and the efficiency of the message communication are better realized.
  • the first shared memory cannot be accessed by other virtual machines on the server other than the first virtual machine; the second shared memory cannot be accessed by other virtual machines on the server other than the second virtual machine. It can be seen that the memory cannot be directly read between the virtual machines, which prevents the destination virtual machine from directly leaking packets from the memory of the source virtual machine, and further avoids direct reading between the virtual machines. Take the security risks caused by the leaked messages.
  • the host process obtains the destination address of the packet and the packet, including: the host process reads the current pointer of the packet, and reads the report from the second shared memory or the host memory according to the current pointer of the packet.
  • the destination address of the text and message Therefore, based on the host process, the destination address of the packet is accurately obtained, and the security of the virtual machine and the efficiency of the message communication are better realized.
  • the host process transmits the packet to the physical network card of the server, including: the host process transmits the current pointer of the packet to the physical network card of the server, and the physical network card is configured to use the current pointer according to the packet from the second share.
  • the message is obtained in the memory and the message is transmitted. It can be seen that the packet is not required to be copied to the physical network card, but the physical network card is directly notified from the shared memory of the virtual machine by the transmission of the pointer, thereby saving the transmission time of the packet and further ensuring the server and other devices. Efficient communication between messages.
  • FIG. 1 is a schematic diagram of a scenario in which a virtual switch and multiple virtual machines are running in a server;
  • FIG. 2 is a flowchart of a message transmission method according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a scenario of message transmission in a virtual machine system
  • FIG. 4 is a schematic structural diagram of a virtual switch according to an embodiment of the present invention.
  • FIG. 1 is a schematic structural diagram of a server, where the server includes hardware layer components such as a memory, a processor, and a physical network card.
  • the physical network card is used to connect the server to other devices by using the network, and the server transmits the message through these physical devices through the physical network card.
  • the memory stores the applications and the data generated by these applications during the run.
  • the processor runs an application stored in the memory to build and run at least one virtual switch and at least two virtual machines on the server. Take the first virtual machine and the second virtual machine in FIG. 1 as an example.
  • Each virtual machine is allocated virtual machine memory, and the server has host memory.
  • the virtual machine memory and host memory are used to store messages.
  • the virtual switch is allocated with a memory as a receiving queue, a pointer for storing a message, and the like.
  • FIG. 1 The function of the virtual switch is implemented by the host process in the server.
  • Figure 2 shows the process of the virtual switch, the first virtual machine, the second virtual machine, and the physical network card in FIG.
  • transmitting a message the following steps are included:
  • S201 The virtual switch puts the pointer of the received packet into a receiving queue of the virtual switch.
  • the pointer of the packet points to the address stored in the second shared memory of the second virtual machine, where the second shared memory is the memory allocated for the second virtual machine access; or, the message The pointer points to the address where the message is stored in the host memory.
  • the pointer of the packet is placed in the receive queue of the virtual switch to notify the virtual switch that packet transmission needs to be started.
  • S202 The virtual switch reads a pointer of the packet in the receiving queue.
  • S203 The virtual switch reads the packet from the second shared memory or the host memory of the second virtual machine according to the read pointer.
  • S204 The virtual switch obtains the destination address of the packet by parsing the read packet.
  • the virtual switch can find a field related to the destination address in each field in the message, thereby extracting the destination address of the packet.
  • the purpose of the above S202-S204 is to obtain the destination address of the packet and the packet, and the manner in which the virtual switch obtains the destination address is not limited to the above steps, and other implementations may be adopted, which are not described in detail herein.
  • S205 The virtual switch determines whether the destination address of the packet is an address of the first virtual machine or an address different from the physical address of the server. If the destination address is the address of the first virtual machine, executing S206, if the destination address is physical with the server If the address is different, then S208 is executed.
  • the first virtual machine here is the virtual machine running on the same server as the second virtual machine in FIG. 1, if the destination address is the address of the first virtual machine, the message is two virtual machines on the same server. If the destination address is an address different from the physical address of the server, the packet is transmitted between the server and other devices except the server. At this time, S208 is performed. It can be seen that, in this embodiment, the processing manners adopted for the packets with different destination addresses are different.
  • S206 The virtual switch copies the packet from the second shared memory or the host memory to the first shared memory of the first virtual machine.
  • the first shared memory is the memory allocated for the first virtual machine access.
  • S207 The virtual switch places the pointer of the packet copied to the first shared memory into the receiving queue of the first virtual machine, and then the first virtual machine can use the pointer of the packet to read the packet.
  • the DMA Direct Memory Access
  • the DMA Direct Memory Access
  • the first shared memory cannot be accessed by other virtual machines except the first virtual machine on the server, and the second shared memory cannot be divided by the virtual machine other than the second virtual machine. access.
  • each virtual machine can only access the contents of the packets in its own shared memory, and cannot access the contents of the packets in the shared memory of other virtual machines.
  • the shared memory of each virtual machine is invisible to other virtual machines.
  • the packet exchange between the virtual machines is performed through the virtual switch. That is, the transmission of packets from the source virtual machine to the destination virtual machine needs to be replicated through the virtual switch. And the virtual switch puts the pointer of the message copied to the destination virtual machine to the destination virtual machine.
  • the receiving queue when a virtual machine on the server crashes, it does not affect the operation of the virtual machine, guarantees the reliability of the virtual machine system, and simultaneously copies the packet from the source virtual machine to the destination virtual machine through the virtual switch.
  • the security of the virtual machine is ensured by the virtual machine in the prior art, which avoids the security risk of the packet leakage caused by the direct reading of the packet from the source virtual machine.
  • S208 The virtual switch places the pointer of the packet into the sending queue of the physical network card, to notify the physical NIC of the server to transmit the packet to the destination address.
  • the physical network card reads the pointer of the packet from the sending queue, and then reads the packet from the second shared memory or the host memory of the second virtual machine according to the pointer, and transmits the packet to the destination address.
  • the shared memory of the host memory and the virtual machine is visible to the physical network card.
  • the virtual switch will be in the shared memory of the source virtual machine or The pointer of the packet in the host memory is placed in the sending queue of the physical network card.
  • the physical network card reads the packet directly from the shared memory or the host memory of the source virtual machine based on the pointer and transmits the packet to the destination address instead of the virtual switch. Copy the packets in the memory of the source VM or the memory of the host to the cache of the physical NIC, and then update the send queue of the physical NIC. This avoids the time consumption of the virtual switch to copy packets to the physical NIC and ensures packet communication. High efficiency.
  • the virtual switch When the packet of the second virtual machine needs to be sent to the first virtual machine, the virtual switch reads the packet from the second shared memory of the second virtual machine, and then the virtual switch copies the packet to the first virtual machine. In the first shared memory. That is, the process of transmitting the packet from the second shared memory to the first shared memory is performed by the virtual switch after a packet copy operation. At this point, the virtual switch completes the packet from the second virtual machine to the first virtual machine. Transmission. That is, the virtual switch completes the packet exchange between the virtual machine and the virtual machine through packet replication. The difference between the source virtual machine and the destination virtual machine is directly read from the memory of the other party. This avoids the presence of sneak peek messages between virtual machines and ensures the security of message communication between virtual machines.
  • the message in the first virtual machine needs to be transmitted by another device different from the physical address of the server.
  • the virtual switch notifies the physical network card to read the message from the second shared memory of the second virtual machine and transmit it through the delivery of the pointer. That is to say, the shared memory of the virtual machine is directly accessible to the physical network card, and the physical network card can directly read the packet pointed by the pointer in the shared memory of the virtual machine by using the pointer.
  • the virtual switch does not need to be
  • the packets are copied to the physical NIC to save the packet replication time. This ensures that the server can transmit packets to other devices except the server.
  • the processor implements the flow shown in FIG. 2 by running an application stored in the memory.
  • FIG. 4 is a schematic structural diagram of the virtual switch in FIG. 1, including the following structure:
  • the message and address obtaining module 401 is configured to obtain a destination address of the message and the message.
  • the address judging module 402 is configured to determine the destination address of the packet. If the destination address of the packet is the address of the first virtual machine, the packet replication module 403 is run. If the destination address of the packet is different from the physical address of the server, the operation report is The text trigger module 404.
  • the message copying module 403 is configured to copy the message into the first shared memory.
  • the first virtual machine is a virtual machine running on the server, and the first shared memory is the allocated memory for the first virtual machine access.
  • the message is in the second shared memory or host memory before being transmitted, the second shared memory is the memory allocated for the second virtual machine access, and the second virtual machine is the virtual machine running on the server.
  • the transmission triggering module 404 is configured to notify the physical network card of the server to obtain the packet and transmit the packet.
  • the transmission triggering module 404 can notify the physical network card to transmit the packet to the destination address by placing the pointer of the packet into the sending queue of the physical network card. After that, the physical network card reads the pointer of the packet to be sent from the sending queue, and then reads the packet from the second shared memory or the host memory of the second virtual machine according to the pointer and transmits the packet to the destination address.
  • Figure 4 shows an implementation of a virtual switch.
  • the implementation of each module in the virtual switch can be implemented as described in the previous section.

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种报文传输方法、虚拟交换机及服务器，方法包括：服务器的主机进程获得报文及报文的目的地址；如果报文的目的地址为第一虚拟机的地址，主机进程将报文复制到运行在服务器上的第一虚拟机的第一共享内存中；如果报文的目的地址与服务器的物理地址不同，主机进程通知服务器的物理网卡获得报文并进行传输。本发明基于报文的目的地址的不同，以不同的方式进行报文交互，若目的地址为运行在服务器上的虚拟机的地址，则将报文从源虚拟机复制到目的虚拟机的共享内存，保证了虚拟机的内存的安全性；若目的地址与服务器的物理地址不同，则通知物理网卡直接读取报文并进行传输，保证报文通信的高效性。

Description

一种报文传输方法、虚拟交换机及服务器 技术领域
本申请涉及通信领域，尤其涉及一种报文传输方法、虚拟交换机及服务器。
背景技术
在虚拟化技术中，一台服务器上能够运行多个虚拟机，服务器能够通过物理网卡与其它设备相连接，而虚拟机之间的通信可以通过服务器上运行的虚拟交换机来实现，服务器上的虚拟机与服务器之外的其它设备的通信也可以通过虚拟交换机来实现。
目前，亟需一种报文传输方案，兼顾虚拟机的安全性和报文通信的高效性。
发明内容
本申请提供了一种报文传输方法、虚拟交换机及服务器，目的在于兼顾虚拟机的安全性和报文通信的高效性。
本发明的第一方面提供了一种报文传输方法，其中包括以下步骤：服务器的主机进程获得报文及报文的目的地址，如果报文的目的地址为第一虚拟机的地址，主机进程将报文复制到运行在服务器上的第一虚拟机的第一共享内存中，如果报文的目的地址与服务器的物理地址不同，主机进程通知服务器的物理网卡获得报文并进行传输。可见，在报文在进行传输时，基于报文的目的地址的不同，以不同的方式发送报文：若目的地址为运行在服务器上的虚拟机的地址，则将报文从源虚拟机复制到目的虚拟机的共享内存中，避免了现有技术中目的虚拟机利用指针直接从源虚拟机中读取报文而导致的报文泄密的安全隐患，保证了虚拟机的内存的安全性；若目的地址与服务器的物理地址不同，则通知物理网卡直接读取报文并进行传输，而不是将报文复制到物理网卡的缓存中，由此节省了报文复制的时间消耗，保证报文通信的高效性。综上所述，实现了兼顾虚拟机的安全性和 报文通信的高效性的目的。
本发明的第二方面提供了一种虚拟交换机，其中包括有以下结构：
报文及地址获得模块获得报文及报文的目的地址，地址判断模块判断报文的目的地址，如果报文的目的地址为第一虚拟机的地址，则运行报文复制模块将报文复制到运行在服务器上的第一虚拟机的第一共享内存中，如果报文的目的地址与服务器的物理地址不同，则运行报文触发模块通知服务器的物理网卡获得报文并进行传输。可见，虚拟交换机在报文在进行传输时，基于报文的目的地址的不同，以不同的方式发送报文：若目的地址为运行在服务器上的虚拟机的地址，则将报文从源虚拟机复制到目的虚拟机的共享内存，避免了现有技术中目的虚拟机利用指针直接从源虚拟机中读取报文而导致的报文泄密的安全隐患，保证了虚拟机的内存的安全性；若目的地址与服务器的物理地址不同，则通知物理网卡直接读取报文并进行传输，而不是将报文复制到物理网卡的缓存中，由此节省了报文复制的时间消耗，保证报文通信的高效性。综上所述，实现了兼顾虚拟机的安全性和报文通信的高效性的目的。
本发明的第三方面提供了一种服务器，其中包括以下结构：
存储应用程序及应用程序运行过程中所产生的数据的存储器、物理网卡及处理器，处理器通过运行应用程序，构建虚拟交换机及至少两个虚拟机，其中的虚拟交换机获得报文及报文的目的地址后，如果报文的目的地址为第一虚拟机的地址，将报文复制到运行在服务器上的第一虚拟机的第一共享内存中，如果报文的目的地址与服务器的物理地址不同，通知服务器的物理网卡获得报文并进行传输。由此可知，服务器在传输报文时，基于报文的目的地址的不同，以不同的方式发送报文：若目的地址为运行在服务器上的虚拟机的地址，则将报文从源虚拟机复制到目的虚拟机的共享内存，避免了现有技术中目的虚拟机利用指针直接从源虚拟机中读取报文而导致的报文泄密的安全隐患，保证了虚拟机的内存的安全性；若目的地址与服务器的物理地址不同，则通知物理网卡直接读取报文并进行传输，而不是将报文复制到物理网卡的缓存中，由此节省了报文复制的时间消耗，保证报文通信的高效性。综上所述，实现了兼顾虚拟机的安全性和报文通 信的高效性的目的。
在一个实现方式中，报文在被传输之前处于第二共享内存或主机内存，第二共享内存是为第二虚拟机访问所分配的内存，第二虚拟机为运行在服务器上的虚拟机。由此，基于此主机进程准确的获得报文的目的地址，更好的实现兼顾虚拟机的安全性和报文通信的高效性的目的。
在一个实现方式中，第一共享内存不能被服务器上除第一虚拟机之外的其它虚拟机访问；第二共享内存不能被服务器上除第二虚拟机之外的其它虚拟机访问。可见，虚拟机之间不能直接进行内存读取，避免了目的虚拟机直接从源虚拟机的内存中读取报文时出现报文被泄密的情况，进一步避免虚拟机之间直接进行报文读取所导致的报文泄密的安全隐患。
在一个实现方式中，主机进程获得报文及报文的目的地址，包括：主机进程读取报文的当前指针，并根据报文的当前指针，从第二共享内存或主机内存中读取报文及报文的目的地址。由此，基于此主机进程准确的获得报文的目的地址，更好的实现兼顾虚拟机的安全性和报文通信的高效性的目的。
在一个实现方式中，主机进程将报文经由服务器的物理网卡进行传输，包括：主机进程将报文的当前指针传输给服务器的物理网卡，物理网卡用于依据报文的当前指针从第二共享内存中获得报文并将报文进行传输。可见，无需将报文复制到物理网卡，而是通过指针的传输通知物理网卡直接从虚拟机的共享内存中进行报文的读取，节省了报文的传输时间，进一步保证服务器与其它设备之间进行报文通信的高效性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为服务器中运行有虚拟交换机及多个虚拟机的场景示意图；
图2为本发明实施例公开的一种报文传输方法的流程图；
图3为虚拟机系统中报文传输的场景示意图；
图4为本发明实施例公开的一种虚拟交换机的结构示意图。
具体实施方式
图1所示为一台服务器的结构示意图，其中，服务器中包括有存储器、处理器和物理网卡等硬件层组件。物理网卡用于利用网络连接服务器与其它设备，服务器通过物理网卡与这些设备进行报文的传输。存储器中存储有应用程序以及这些应用程序在运行过程中产生的数据。处理器运行存储器中所存储的应用程序，以在服务器上构建并运行至少一个虚拟交换机及至少两个虚拟机。以图1中第一虚拟机及第二虚拟机为例。每个虚拟机均被分配有虚拟机内存，服务器内有主机内存，这里的虚拟机内存及主机内存用于存储报文等。虚拟交换机被分配有作为接收队列的内存，用于存放报文的指针等。
虚拟交换机的功能是通过服务器中的主机进程来实现的，图2所示为图1中的虚拟交换机、第一虚拟机、第二虚拟机以及物理网卡协同进行报文传输的过程，虚拟交换机实现报文传输时，包括以下步骤：
S201：虚拟交换机将接收到的报文的指针放到虚拟交换机的接收队列中。
需要说明的是，报文的指针指向在第二虚拟机的第二共享内存中报文所存放的地址，其中的第二共享内存是为第二虚拟机访问所分配的内存；或者，报文的指针指向主机内存中报文所存放的地址。报文的指针被放到虚拟交换机的接收队列中，来通知虚拟交换机需要开始进行报文传输。
S202：虚拟交换机读取接收队列中报文的指针。
S203：虚拟交换机根据读取到的指针，从第二虚拟机的第二共享内存或主机内存中读取报文。
S204：虚拟交换机通过解析读取到的报文，获得报文的目的地址。
在一种实现中，虚拟交换机可以在报文中的各个字段中找到与目的地址相关的字段，由此来提取出报文的目的地址。
以上S202-S204的目的在于实现虚拟交换机获得报文及报文的目的地址，而虚拟交换机获得目的地址的方式并不限于以上步骤，还可以采用其它可实现方案，此处不再详述。
S205：虚拟交换机判断报文的目的地址是第一虚拟机的地址还是与服务器的物理地址不同的地址，若目的地址为第一虚拟机的地址，则执行S206，若目的地址为与服务器的物理地址不同的地址，那么执行S208。
因为这里的第一虚拟机是图1中与第二虚拟机运行在同一服务器上的虚拟机，所以若目的地址为第一虚拟机的地址，则说明报文是在同一服务器的两个虚拟机之间进行传输，此时执行S206；若目标地址为与服务器的物理地址不同的地址，则说明报文是在服务器与除服务器之外的其它设备之间进行传输，此时执行S208。可见，本实施例中，对于目的地址不同的报文，采用的处理方式不同。
S206：虚拟交换机将报文从第二共享内存或主机内存复制到第一虚拟机的第一共享内存中。
其中的第一共享内存是为第一虚拟机访问所分配的内存。
S207：虚拟交换机将复制到第一共享内存的报文的指针放置到第一虚拟机的接收队列中，后续可以由第一虚拟机利用报文的指针对报文进行读取等操作。
可选的，本发明实施例中，虚拟交换机在进行内存的读取或写入时，采用DMA(Direct Memory Access，直接内存存取)技术，以进一步提升报文通信的效率。
从以上方案中可知，在服务器上，第一共享内存不能被服务器上除第一虚拟机之外的其它虚拟机访问，第二共享内存不能被服务器上除第二虚拟机之外的其它虚拟机访问。
也就是说，每个虚拟机均只能访问自己的共享内存中的报文内容，不能访问其它虚拟机的共享内存中的报文内容。各虚拟机的共享内存对于其它虚拟机不可见，虚拟机之间的报文交互都是通过虚拟交换机进行的，即报文从源虚拟机到目的虚拟机的传输需要通过虚拟交换机进行复制来完成的，并且虚拟交换机将复制到目的虚拟机的报文的指针放到目的虚拟机的 接收队列中，因此，在服务器上的某个虚拟机发生崩溃时，不会影响虚拟机的运行，保证虚拟机系统的可靠性，同时，通过虚拟交换机将报文从源虚拟机复制到目的虚拟机，避免了现有技术中目的虚拟机利用指针直接从源虚拟机中读取报文而导致的报文泄密的安全隐患，保证了虚拟机的内存的安全性。
S208：虚拟交换机将报文的指针放置到物理网卡的发送队列中，以通知服务器的物理网卡向目的地址传输报文。
之后，物理网卡从发送队列中读取报文的指针，再根据指针从第二虚拟机的第二共享内存或主机内存中读取出报文，并将报文向目的地址进行传输。
从以上方案可知，在服务器上，主机内存与虚拟机的共享内存对于物理网卡是可见的，报文向通过物理网卡与服务器连接的其它设备传输时，虚拟交换机将源虚拟机的共享内存中或主机内存中的报文的指针放到物理网卡的发送队列中，由物理网卡基于指针直接从源虚拟机的共享内存或主机内存中读取出报文并向目的地址传输，而不是由虚拟交换机将源虚拟机的内存或主机内存中的报文复制到物理网卡的缓存，再去更新物理网卡的发送队列，由此避免了虚拟交换机复制报文到物理网卡的时间消耗，保证报文通信的高效性。
图2所示的报文传输示意如图3所示：
在第二虚拟机的报文需要向第一虚拟机发送时，虚拟交换机从第二虚拟机的第二共享内存中读取出报文，之后，虚拟交换机将报文复制到第一虚拟机的第一共享内存中。即为：报文是从第二共享内存传输到第一共享内存的过程，是由虚拟交换机经过一次报文复制操作来完成，至此，虚拟交换机完成报文由第二虚拟机到第一虚拟机的传输。也就是说，虚拟交换机通过报文复制完成虚拟机与虚拟机之间的报文交互，区别于现有技术中源虚拟机与目的虚拟机之间直接从对方的内存中进行报文读取操作，避免了虚拟机之间存在偷窥报文的情况，保证了虚拟机之间进行报文通信的安全性。
而在第一虚拟机中的报文需要与服务器的物理地址不同的其它设备传 输时，虚拟交换机通过指针的传递通知物理网卡从第二虚拟机的第二共享内存中读取出报文并进行传输。也就是说，虚拟机的共享内存对于物理网卡来说是可以直接访问的，物理网卡利用指针能够在虚拟机的共享内存中直接读取指针所指向的报文，这一过程中，虚拟交换机无需将报文复制到物理网卡中，节省报文复制的时间，以保证服务器向服务器之外的其它设备进行报文传输的高效性。
图1中所示的服务器中，处理器通过运行存储器中存储的应用程序，实现图2中所示的流程。
图4为图1中的虚拟交换机的结构示意，包括以下结构：
报文及地址获得模块401，用于获得报文及报文的目的地址。
地址判断模块402，用于判断报文的目的地址，如果报文的目的地址为第一虚拟机的地址，运行报文复制模块403，如果报文的目的地址与服务器的物理地址不同，运行报文触发模块404。
报文复制模块403，用于将报文复制到第一共享内存中。第一虚拟机为运行在服务器上的虚拟机，第一共享内存是为第一虚拟机访问所分配的内存。
而报文在被传输之前处于第二共享内存或主机内存，第二共享内存是为第二虚拟机访问所分配的内存，第二虚拟机为运行在所述服务器上的虚拟机。
传输触发模块404，用于通知所述服务器的物理网卡获得所述报文并进行传输。
而传输触发模块404可以通过将报文的指针放置到物理网卡的发送队列中，来实现通知物理网卡将报文向目的地址进行传输的目的。之后，物理网卡从发送队列中读取待发送的报文的指针，再根据指针，从第二虚拟机的第二共享内存或主机内存中读取报文并向目的地址进行传输。
图4所示为虚拟交换机的一种实现结构，虚拟交换机中各个模块的实现功能可以参考前文中实现，此处不再详述。
本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其它实施例的不同之处，各个实施例之间相同或相似部分互相参见即可。

Claims (15)

  1. 一种报文传输方法，其特征在于，包括：
    服务器的主机进程获得报文及所述报文的目的地址；
    如果所述报文的目的地址为第一虚拟机的地址，所述主机进程将所述报文复制到第一共享内存中，所述第一虚拟机为运行在所述服务器上的虚拟机，所述第一共享内存是为所述第一虚拟机访问所分配的内存；
    如果所述报文的目的地址与所述服务器的物理地址不同，所述主机进程通知所述服务器的物理网卡获得所述报文并进行传输。
  2. 根据权利要求1所述的方法，其特征在于，所述报文在被传输之前处于第二共享内存或主机内存，所述第二共享内存是为第二虚拟机访问所分配的内存，所述第二虚拟机为运行在所述服务器上的虚拟机。
  3. 根据权利要求2所述的方法，其特征在于，所述第一共享内存不能被所述服务器上除所述第一虚拟机之外的其它虚拟机访问；
    所述第二共享内存不能被所述服务器上除所述第二虚拟机之外的其它虚拟机访问。
  4. 根据权利要求3所述的方法，其特征在于，所述主机进程获得报文及所述报文的目的地址，包括：
    所述主机进程读取报文的当前指针；
    所述主机进程根据所述报文的当前指针，从所述第二共享内存或所述主机内存中读取所述报文及所述报文的目的地址。
  5. 根据权利要求3所述的方法，其特征在于，所述主机进程通知所述服务器的物理网卡获得所述报文并进行传输，包括：
    所述主机进程将所述报文的当前指针传输给所述服务器的物理网卡，所述物理网卡用于依据所述报文的当前指针从所述第二共享内存中获得所述报文并将所述报文进行传输。
  6. 一种虚拟交换机，其特征在于，包括：
    报文及地址获得模块，用于获得报文及所述报文的目的地址；
    地址判断模块，用于判断所述报文的目的地址，如果所述报文的目的地址为第一虚拟机的地址，运行报文复制模块，如果所述报文的目的地址 与所述服务器的物理地址不同，运行报文触发模块；
    报文复制模块，用于将所述报文复制到第一共享内存中，所述第一虚拟机为运行在所述服务器上的虚拟机，所述第一共享内存是为所述第一虚拟机访问所分配的内存；
    传输触发模块，用于通知所述服务器的物理网卡获得所述报文并进行传输。
  7. 根据权利要求6所述的虚拟交换机，其特征在于，所述报文在被传输之前处于第二共享内存或主机内存，所述第二共享内存是为第二虚拟机访问所分配的内存，所述第二虚拟机为运行在所述服务器上的虚拟机。
  8. 根据权利要求7所述的虚拟交换机，其特征在于，所述第一共享内存不能被所述服务器上除所述第一虚拟机之外的其它虚拟机访问；
    所述第二共享内存不能被所述服务器上除所述第二虚拟机之外的其它虚拟机访问。
  9. 根据权利要求8所述的虚拟交换机，其特征在于，所述报文及地址获得模块具体用于：
    读取报文的当前指针，并根据所述报文的当前指针，从所述第二共享内存或所述主机内存中读取所述报文及所述报文的目的地址。
  10. 根据权利要求8所述的虚拟交换机，其特征在于，所述传输触发模块具体用于：
    将所述报文的当前指针传输给所述服务器的物理网卡，所述物理网卡用于依据所述报文的当前指针从所述第二共享内存中获得所述报文并将所述报文进行传输。
  11. 一种服务器，其特征在于，包括：
    存储器，用于存储应用程序及所述应用程序运行过程中所产生的数据；
    物理网卡；
    处理器，用于通过运行所述应用程序，构建虚拟交换机及至少两个虚拟机；
    所述虚拟交换机，用于获得报文及所述报文的目的地址，如果所述报文的目的地址为第一虚拟机的地址，将所述报文复制到第一共享内存中， 所述第一虚拟机为运行在所述服务器上的虚拟机，所述第一共享内存是为所述第一虚拟机访问所分配的内存，如果所述报文的目的地址与所述服务器的物理地址不同，通知所述服务器的物理网卡获得所述报文并进行传输。
  12. 根据权利要求11所述的服务器，其特征在于，所述报文在被传输之前处于第二共享内存或主机内存，所述第二共享内存是为第二虚拟机访问所分配的内存，所述第二虚拟机为运行在所述服务器上的虚拟机。
  13. 根据权利要求12所述的服务器，其特征在于，所述第一共享内存不能被所述服务器上除所述第一虚拟机之外的其它虚拟机访问；
    所述第二共享内存不能被所述服务器上除所述第二虚拟机之外的其它虚拟机访问。
  14. 根据权利要求13所述的服务器，其特征在于，所述虚拟交换机获得报文及所述报文的目的地址，具体为：
    所述虚拟交换机读取报文的当前指针，并根据所述报文的当前指针，从所述第二共享内存或所述主机内存中读取所述报文及所述报文的目的地址。
  15. 根据权利要求13所述的服务器，其特征在于，所述虚拟交换机通知所述服务器的物理网卡获得所述报文并进行传输，具体为：
    所述虚拟交换机将所述报文的当前指针传输给所述服务器的物理网卡，所述物理网卡用于依据所述报文的当前指针从所述第二共享内存中获得所述报文并将所述报文进行传输。
PCT/CN2016/087482 2016-06-28 2016-06-28 一种报文传输方法、虚拟交换机及服务器 WO2018000195A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/087482 WO2018000195A1 (zh) 2016-06-28 2016-06-28 一种报文传输方法、虚拟交换机及服务器

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/087482 WO2018000195A1 (zh) 2016-06-28 2016-06-28 一种报文传输方法、虚拟交换机及服务器

Publications (1)

Publication Number Publication Date
WO2018000195A1 true WO2018000195A1 (zh) 2018-01-04

Family

ID=60785636

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/087482 WO2018000195A1 (zh) 2016-06-28 2016-06-28 一种报文传输方法、虚拟交换机及服务器

Country Status (1)

Country Link
WO (1) WO2018000195A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111756651A (zh) * 2020-06-19 2020-10-09 浪潮电子信息产业股份有限公司 一种流量传输方法、装置、设备、介质
CN113867993A (zh) * 2021-12-03 2021-12-31 维塔科技(北京)有限公司 虚拟化的rdma方法、系统、存储介质及电子设备
WO2022151820A1 (zh) * 2021-01-14 2022-07-21 华为技术有限公司 数据传输系统、数据传输方法以及网络设备
CN116233038A (zh) * 2022-12-29 2023-06-06 天翼云科技有限公司 一种虚拟交换机热升级的方法和装置
CN116662038A (zh) * 2023-07-25 2023-08-29 菲特（天津）检测技术有限公司 基于共享内存的工业信息检测方法、装置、设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100306358A1 (en) * 2009-05-29 2010-12-02 Sun Microsystems, Inc. Handling of multiple mac unicast addresses with virtual machines
CN103621026A (zh) * 2013-04-01 2014-03-05 华为技术有限公司 虚拟机的数据交换方法、装置和系统
CN104158764A (zh) * 2014-08-12 2014-11-19 杭州华三通信技术有限公司 报文处理方法及装置
CN105049412A (zh) * 2015-06-02 2015-11-11 深圳市联软科技有限公司 一种不同网络间数据安全交换方法、装置及设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100306358A1 (en) * 2009-05-29 2010-12-02 Sun Microsystems, Inc. Handling of multiple mac unicast addresses with virtual machines
CN103621026A (zh) * 2013-04-01 2014-03-05 华为技术有限公司 虚拟机的数据交换方法、装置和系统
CN104158764A (zh) * 2014-08-12 2014-11-19 杭州华三通信技术有限公司 报文处理方法及装置
CN105049412A (zh) * 2015-06-02 2015-11-11 深圳市联软科技有限公司 一种不同网络间数据安全交换方法、装置及设备

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111756651A (zh) * 2020-06-19 2020-10-09 浪潮电子信息产业股份有限公司 一种流量传输方法、装置、设备、介质
WO2022151820A1 (zh) * 2021-01-14 2022-07-21 华为技术有限公司 数据传输系统、数据传输方法以及网络设备
CN113867993A (zh) * 2021-12-03 2021-12-31 维塔科技(北京)有限公司 虚拟化的rdma方法、系统、存储介质及电子设备
CN113867993B (zh) * 2021-12-03 2022-03-04 维塔科技(北京)有限公司 虚拟化的rdma方法、系统、存储介质及电子设备
CN116233038A (zh) * 2022-12-29 2023-06-06 天翼云科技有限公司 一种虚拟交换机热升级的方法和装置
CN116662038A (zh) * 2023-07-25 2023-08-29 菲特（天津）检测技术有限公司 基于共享内存的工业信息检测方法、装置、设备及介质
CN116662038B (zh) * 2023-07-25 2023-10-27 菲特（天津）检测技术有限公司 基于共享内存的工业信息检测方法、装置、设备及介质

Similar Documents

Publication Publication Date Title
WO2018000195A1 (zh) 一种报文传输方法、虚拟交换机及服务器
US8898665B2 (en) System, method and computer program product for inviting other virtual machine to access a memory space allocated to a virtual machine
US11372802B2 (en) Virtual RDMA switching for containerized applications
WO2018120986A1 (zh) 转发报文的方法和物理主机
US9304896B2 (en) Remote memory ring buffers in a cluster of data processing nodes
US20190266124A1 (en) Methods for enabling direct memory access (dma) capable devices for remote dma (rdma) usage and devices thereof
US20150263971A1 (en) Physical port sharing in a link aggregation group
US9665534B2 (en) Memory deduplication support for remote direct memory access (RDMA)
US8214424B2 (en) User level message broadcast mechanism in distributed computing environment
US9559940B2 (en) Take-over of network frame handling in a computing environment
CN106301859B (zh) 一种管理网卡的方法、装置及系统
US20140032796A1 (en) Input/output processing
US9864717B2 (en) Input/output processing
US9584628B2 (en) Zero-copy data transmission system
CN104205050A (zh) 访问远程机器上的设备
WO2016206171A1 (zh) 一种基于网络隔离的安全连网方法及终端
US20140044134A1 (en) Duplicate mac address detection
CN114945009B (zh) PCIe总线连接的设备间进行通信的方法、设备及系统
EP2932690A1 (en) Copy offload for disparate offload providers
WO2014004192A1 (en) Performing emulated message signaled interrupt handling
CN112905304A (zh) 一种虚拟机间通信方法、装置、物理主机及介质
US20220200952A1 (en) Network address translation between networks
US20140025859A1 (en) Input/output processing
CN110855726B (zh) 通信方法、装置以及网关、计算设备和介质
WO2017210015A1 (en) Improving throughput in openfabrics environments

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16906597

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16906597

Country of ref document: EP

Kind code of ref document: A1