WO2018086013A1 - 云计算系统中报文处理的方法、主机和系统 - Google Patents

云计算系统中报文处理的方法、主机和系统 Download PDF

Info

Publication number
WO2018086013A1
WO2018086013A1 PCT/CN2016/105227 CN2016105227W WO2018086013A1 WO 2018086013 A1 WO2018086013 A1 WO 2018086013A1 CN 2016105227 W CN2016105227 W CN 2016105227W WO 2018086013 A1 WO2018086013 A1 WO 2018086013A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
network
virtual machine
network port
vlan
Prior art date
Application number
PCT/CN2016/105227
Other languages
English (en)
French (fr)
Inventor
于洲
张磊强
庄毓新
罗浩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to CN201680009031.0A priority Critical patent/CN107278362B/zh
Priority to BR112018000362-0A priority patent/BR112018000362A2/pt
Priority to EP16909061.0A priority patent/EP3343881B1/en
Priority to PCT/CN2016/105227 priority patent/WO2018086013A1/zh
Priority to JP2017568237A priority patent/JP6513835B2/ja
Priority to AU2016414391A priority patent/AU2016414391B2/en
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201910226607.4A priority patent/CN110099014B/zh
Priority to SG11201800101YA priority patent/SG11201800101YA/en
Priority to CA2991208A priority patent/CA2991208C/en
Priority to EP19188526.8A priority patent/EP3654620B1/en
Publication of WO2018086013A1 publication Critical patent/WO2018086013A1/zh
Priority to US16/407,196 priority patent/US10491517B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/58—Association of routers
    • H04L45/586—Association of routers of virtual routers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/70—Virtual switches
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present invention relates to the field of IT technologies, and in particular, to a message processing method, a host, and a system in a cloud computing system.
  • Virtualization technology is one of the key technologies in the field of cloud computing. It can abstract the physical resources of a host into a shared resource pool for use by several virtual machines (VMs) running on the host. Several virtual machines running on the host can share the host's network card and communicate with the host's external network.
  • the network card can be allocated to the virtual machine by means of network card virtualization, and the network card virtualization can adopt Single-Root I/O Virtualization (SR-IOV) or multiple inputs. Multi-root Input/Output Virtualization (MR-IOV).
  • SR-IOV Single-Root I/O Virtualization
  • MR-IOV Multi-root Input/Output Virtualization
  • the above-mentioned network card virtualization is also called NIC pass-through. Take SR-IOV straight through as an example. When the network card supports SR-IOV, the SR-IOV technology can be used to share the host network card to several virtual machines running on the host.
  • the network port of the network card virtualizes at least one physical function (PF) and multiple virtual functions (VF), and the virtual machine on the host is connected to at least A VF.
  • the NIC internally contains a switching device with switch function.
  • the switching device forwards the data packet according to the Media Access Control (MAC) table, and is responsible for packet forwarding between the PF, the VF, and the physical network port.
  • MAC Media Access Control
  • Rich network functions such as security group, quality of service (QoS), Layer 2 tunnel encapsulation, and distributed routing.
  • This document describes a packet processing method, host, and system in a cloud computing system to solve the problem that a network function cannot be provided in a network card through scenario.
  • an embodiment of the present invention provides a host, where at least one network card is connected to the host, The virtual machine monitor VMM is running on the host, and the first virtual machine is running on the VMM.
  • the VMM includes multiple VLAN sub-interfaces and virtual network function modules, and the at least one network card includes a switching device and at least three network ports.
  • the first network port and the second network port support the network card virtualization capability, where the first network port corresponds to at least one physical function PF and multiple logical functions VF, and the multiple VFs are configured with VLAN identifiers, and each The VLAN IDs of the VFs are different from each other.
  • the first virtual machine is connected to at least one VF of the first network port, and the number of the VLAN sub-interfaces is the same as the number of VFs of the first network port.
  • the VLAN sub-interface has the same VLAN identifier as the corresponding VF, and the first network port and the second network port are connected by a network cable.
  • the first virtual machine sends a data packet to the second virtual machine by using the VF connected to the first virtual machine, where the data packet carries a VLAN identifier of the VF that sends the data packet, and the switching device of the first network port receives the data packet.
  • the data packet has a VLAN sub-interface with the same VLAN identifier; the VLAN sub-interface receives the data packet, removes the VLAN identifier of the data packet, and sends the data packet to the virtual network function module, where After performing the network function processing on the modified data packet, the virtual network function module sends the processed data packet to the second virtual machine.
  • the data packet can be sent to the virtual network function module in the VMM by using the above method, and the software module is used to provide the user with rich network functions, and the pair is implemented.
  • the packet is processed by the network function.
  • the mode of the first network port and the second network port is a virtual Ethernet port aggregation VEPA mode.
  • the VEPA mode enables a data packet to be forcibly forwarded between the first network port and the second network port. It should be noted that the VEPA mode is only one of the methods for implementing the data packet forced forwarding. The user may use other software settings or hardware settings to implement the data packet forced forwarding, which is not limited in the embodiment of the present invention.
  • the host further includes a device management module, and the device management module is configured to create a VLAN sub-interface. specific:
  • the device management module is configured to: after the first virtual machine is successfully created, receive a VLAN sub-interface creation request sent by the cloud management platform, where the VLAN sub-interface creation request is carried and assigned to the first virtual VLAN ID of the VF of the machine;
  • the device management module is further configured to send a notification message to the VMM, to notify the VMM to create a VLAN sub-interface corresponding to the VF of the first virtual machine, and the VLAN sub-interface corresponding to the VF of the first virtual machine
  • the VF of the first virtual machine has the same VLAN identifier.
  • the at least one network card includes at least three network ports, and the at least three network ports may be located on the same network card or different network cards.
  • the first network port and the second network port may share switching devices on the network card, or each may have an independent switching device.
  • the source virtual machine (first virtual machine) and the destination virtual machine (second virtual machine) of the data packet are located on the same host, and the virtual network function module sends the processed data packet.
  • a VLAN sub-interface corresponding to the VF connected to the second virtual machine where the VF connected to the second virtual machine has the same VLAN identifier as the VLAN sub-interface that receives the processed data packet;
  • the VLAN sub-interface corresponding to the VF connected to the second virtual machine adds its own VLAN identifier to the data packet, and sends the data packet to the second network port.
  • the switching device of the second network port passes the network cable.
  • the data packet is forcibly forwarded to the first network port; the switching device of the first network port sends the data packet to the VF identified by the VLAN identifier in the data packet according to the VLAN identifier carried in the data packet. So that the data packet is transmitted to the second virtual machine.
  • the source virtual machine (the first virtual machine) and the destination virtual machine (the second virtual machine) of the data packet are located on different hosts, and the virtual network function module is specifically configured to establish a tunnel between another virtual network function module on the host where the virtual machine is located, sending the processed data packet to an external physical switch through the third network port, and the processing is performed by the external physical switch The subsequent data packet is sent to the host where the second virtual machine is located, so that the another virtual network function module sends the processed data packet to the second virtual machine.
  • the embodiment of the present invention further provides a method for processing a message in a cloud computing system, where at least one host in the cloud computing system includes a virtual machine monitor VMM, and At least one network card, the first virtual machine is running on the host, the VMM includes a plurality of VLAN sub-interfaces and a virtual network function module, and the at least one network card includes a switching device and at least three network ports, where the first network The port and the second network port support the network card virtualization capability, and the first network port pair
  • the at least one PF and the plurality of VFs are configured with a VLAN identifier, and the VLAN identifiers of the VFs are different from each other, and the first virtual machine is connected to at least one VF of the first network port.
  • the number of the VLAN sub-interfaces is the same as the number of the VFs of the first network port, and the VLAN sub-interface has the same VLAN identifier as the corresponding VF, and the first network port and the second network
  • the ports are connected by a network cable, and the method includes:
  • the first virtual machine sends a data packet to the second virtual machine by using the VF connected to itself, where the data packet carries a VLAN identifier of the VF that sends the data packet, and an address of the second virtual machine.
  • the switching device of the first network port receives the data packet, and forcibly forwards the data packet to the second network port by using the network cable;
  • the switching device of the second network port receives the data packet from the first network port, and sends the data packet to the VLAN sub-interface identified by the VLAN identifier according to the VLAN identifier carried in the data packet;
  • the virtual network function module After the virtual network function module performs network function processing on the modified data packet, the processed data packet is sent, and the destination address of the processed data packet is an address of the second virtual machine.
  • the mode of the first network port and the second network port is a VEPA mode.
  • the method further includes a VLAN sub-interface creation process, where the VLAN sub-interface creation process includes: after the first virtual machine is successfully created, the device management module of the host receives the VLAN sub-sent by the cloud management platform.
  • An interface creation request the VLAN sub-interface creation request carrying a VLAN identifier of a VF allocated to the first virtual machine; the device management module sending a notification message to the VMM, so that the VMM is created with the first virtual machine
  • the VLAN sub-interface corresponding to the VF of the VF has the same VLAN identifier as the VF of the VF of the first virtual machine.
  • an embodiment of the present invention provides a cloud computing system, where the cloud computing system includes a cloud management platform and the host in the first aspect, where the cloud management platform is configured to be created on the host.
  • the first virtual machine after the first virtual machine is successfully created, notifies the VMM of the host to create a VLAN sub-interface corresponding to the VF of the first virtual machine, where the VF of the first virtual machine corresponds
  • the VLAN sub-interface has the same VLAN identifier as the VF of the first virtual machine.
  • an embodiment of the present invention provides a host having a function of implementing a host defined in the first aspect.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the host includes a first processor, a first memory, and at least one network card, where the network card includes a second processor, a second memory, and at least two network ports, wherein the first one of the at least one network card
  • the network port and the second network port support the network card virtualization capability, where the first network port corresponds to at least one PF and multiple VFs, and the plurality of VFs are configured with VLAN identifiers, and the VLAN identifiers of the VFs are different from each other.
  • the first processor executing a first instruction in the first memory to implement a function of a first virtual machine, the first virtual machine being connected to the Determining at least one VF of the first network port, the first processor executing a second instruction in the first memory to implement a function of a VLAN sub-interface, the first processor executing the first in the first memory
  • the first virtual machine is connected to the at least one VF of the first network port, where the host includes multiple VLAN sub-interfaces, the number of the multiple VLAN sub-interfaces and the number of VFs of the first network port.
  • the VLAN sub-interface and the corresponding VF have the same VLAN identifier
  • the first network port and the second network port are connected by a network cable.
  • the first processor is configured to execute a first instruction in the first memory to perform a step of: transmitting, by using the VF connected to itself, a data packet to a second virtual machine, where the data packet carries the data packet a VLAN identifier of the VF, and an address of the second virtual machine;
  • the second processor is configured to execute an instruction in the second memory to perform the step of: receiving the data packet, and forcibly forwarding the data packet to the second network port by using the network cable;
  • the second processor is configured to execute an instruction in the second memory to perform the steps of: receiving a data packet from a first network port, and sending the data packet to the VLAN according to a VLAN identifier carried by the data packet Identify the identified VLAN subinterface;
  • the first processor is configured to execute a second instruction in the first memory to perform the steps of: receiving the data packet, removing a VLAN identifier of the data packet, and transmitting the data packet to the virtual network functional module;
  • the first processor is configured to execute a third instruction in the first memory to perform a step: after performing network function processing on the modified data packet, processing according to an address of the second virtual machine The packet is sent to the second virtual machine.
  • the host and cloud management platform are implemented by a general purpose or dedicated server, and the structure of the server includes a processor, a memory, a system bus, and an input and output interface, and the processor is configured to support the system.
  • the input and output interface is for communicating with other components in the cloud computing system, and the processor executes instructions stored in the memory.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use by the host, including a program designed to perform the above aspects.
  • an embodiment of the present invention provides another computer storage medium for storing computer software instructions for use in a switching device in the network card, including a program designed to perform the above aspects.
  • an embodiment of the present invention provides a computer program, when the physical server runs the computer program, the physical server performs the functions of a virtual machine, a VLAN sub-interface, and a virtual network function module in the host.
  • an embodiment of the present invention provides a computer program, when a processor or a programmable logic circuit in a network card runs the computer program, the network card performs the functions of the switching device in the foregoing aspect.
  • the virtual machine sends the data packet from the VF connected to the virtual machine, and the switching device of the first network port forwards the data to the second network port.
  • the switching device of the second network port sends the data according to the VLAN identifier carried in the data packet.
  • the packet is sent to the VLAN sub-interface on the VMM, and the data packet is transmitted to the virtual network function module through the VLAN sub-interface, and the virtual network function module provides rich network function processing for the data packet.
  • the data packet can be sent to the virtual network function module in the VMM through the above manner, and the software module is used to provide the user with rich network functions, and the pair is realized.
  • the packet is processed by the network function.
  • FIG. 1A is a schematic diagram of a virtualization structure on a host according to an embodiment of the present invention.
  • FIG. 1B is a schematic diagram of a virtualization structure on a host in a NIC passthrough scenario according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a virtualization architecture on another host provided by the implementation of the present invention.
  • FIG. 3 is a schematic diagram of a process for creating a virtual machine according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a method for processing a packet in a cloud computing system according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of hardware of a computer device according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a cloud computing system according to an embodiment of the present invention.
  • the network architecture and the service scenario described in the embodiments of the present invention are used to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation of the technical solutions provided by the embodiments of the present invention.
  • the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.
  • FIG. 1A is a schematic diagram of a virtualization structure on a host according to an embodiment of the present invention.
  • the host is a physical server.
  • the bottom layer of the physical server is the hardware layer.
  • the hardware layer mainly includes hardware resources such as a central processing unit (CPU), memory, hard disk, and network card.
  • Server virtualization is a virtualized operating environment for multiple virtual machines (VMs) on a physical server with virtualization software such as VMWare ESX and Citrix XEN.
  • the software layer that is installed on the server to implement the virtualized environment is called the Virtual Machine Monitor (VMM).
  • the VMM running on top of the hardware layer assumes the scheduling, allocation, and management of hardware resources in the hardware layer.
  • Running multiple virtual machine VMs on top of VMM, VMM provides virtualized CPU and memory for each virtual machine.
  • Hardware environments such as storage, IO devices (such as network cards), and Ethernet switches ensure that multiple virtual machines run in isolation from each other.
  • the VMM creates a virtual network interface card (vNIC) for each virtual machine.
  • the virtual switch VSwitch provides communication between virtual machines and between virtual machines and external networks.
  • the virtual NIC of each virtual machine corresponds to a logical port of the VSwitch.
  • the physical NIC of the host corresponds to the port that the VSwitch connects to the external physical switch.
  • the virtual network function module in the VMM performs network function processing on the passed data. Since the virtual network function module is a software module, it can be updated as needed, and therefore, the virtual in the VMM
  • the network function module can provide users with rich network functions.
  • the physical port's network port support virtualization capability can be achieved by Single Root Input/Output Virtualization (SR-IOV) or Multiple Root Input/Output Virtualization (MR-IOV).
  • SR-IOV Single Root Input/Output Virtualization
  • MR-IOV Multiple Root Input/Output Virtualization
  • the embodiment of the present invention is described by taking the SR-IOV technology as an example.
  • SR-IOV technology is a hardware-based virtualization solution that efficiently shares PCIe (Peripheral Component Interconnect Express) devices between virtual machines, and because SR-IOV technology is implemented in hardware Therefore, it is possible to obtain efficient I/O performance.
  • PCIe Peripheral Component Interconnect Express
  • PCI-SIG Peripheral Component Interconnect Special Interest Group
  • an SR-IOV-enabled PCIe device (such as a network port of a physical NIC) can be displayed as multiple separate devices, each of which shows a separate PCIe configuration space.
  • the physical network card supporting the SR-IOV includes a plurality of network ports, and the SR-IOV capability can be enabled/disabled for each network port.
  • the network port with the SR-IOV capability enabled corresponds to at least one physical function. (Physical Function, PF) and multiple Virtual Functions (VF).
  • each PF can have up to 64,000 VFs associated with it. After creating a VF, you can directly assign the VF to the host.
  • the virtual machine is used such that the plurality of virtual machines share the PCIe device through at least one VF connected thereto.
  • FIG. 1B is a schematic diagram of a virtualization structure on a host in a NIC passthrough scenario according to an embodiment of the present invention.
  • the physical NIC supports a single IO virtualization, and one network port of the physical NIC corresponds to For at least one PF and multiple VFs, each VF can share physical resources (such as a network card port) of the physical network card.
  • the switching device is a virtual ethernet bridge & classifier.
  • the implementation of the network card through is implemented by the SR-IOV or the MR-IOV, which is not limited by the embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a virtualization architecture on another host provided by the implementation of the present invention.
  • the host includes a VMM and at least one physical network card, and the host runs at least one virtual machine.
  • the at least one physical network card includes at least three network ports, wherein the first network port and the second network port support the network card virtualization capability, and the third network port is connected to the physical switch outside the host, and is responsible for sending and receiving the network across the host. flow.
  • the first network port virtualizes at least one PF and at least two VFs (illustrated by taking two VFs in FIG. 2 as an example), and the first virtual machine and the second virtual machine are installed with a VF driver, a first virtual machine, and a second virtual machine.
  • the virtual machine is connected to at least one VF.
  • the first network port and the second network port are directly connected through the network cable.
  • the PF of the second network port is connected to the VLAN sub-interface on the VMM. Therefore, the traffic sent from the virtual machine passes.
  • the networking cable returns to the second network port, and the second network port directs traffic back to the virtual network function module in the VMM.
  • the network cable may specifically be a cable of various media, including twisted pairs, optical fibers, coaxial cables, and the like.
  • the first network port and the second network port are directly connected through the network cable, so that the data packet sent by the virtual machine connected to the VF of the first network port is forcibly forwarded to the second network port, so that the data packet transmission path is It must pass the virtual network function module on the VMM, so that on the basis of the network card direct communication, the virtual network function module in the VMM provides rich virtual network functions.
  • the network card supporting the network card virtualization function can be virtualized into at least one PF and multiple VFs. It is not limited to two, and the number of corresponding VLAN sub-interfaces is not limited to two.
  • the network card virtualization specifically refers to network card hardware virtualization.
  • the first network port is referred to as a direct network port
  • the second network port is referred to as a bypass network port
  • the third network port is referred to as a service network port.
  • the direct-through network port uses the standard SR-IOV/MR-IOV technology to connect the VF to the virtual machine.
  • Direct communication between virtual machines forces the virtual machine's data packets to be sent from the network cable.
  • a VLAN ID represents a broadcast domain.
  • the VFs connected to the VMs are in different broadcast domains.
  • the broadcast packets can only be sent to one VLAN.
  • the virtual machine therefore, the broadcast packets sent by the VM can only be received by the VM itself and the PF through different VLAN IDs set for each VF.
  • VLAN IDs on different hosts can be the same.
  • VLAN sub-interface Create a VLAN sub-interface on the VMM.
  • the number of VLAN sub-interfaces is the same as that of the VF.
  • the VLAN ID of the VLAN sub-interface corresponds to the VLAN ID of the VF on the directly-connected network port.
  • the network port connected to the straight-through network port on the network port can be either PF or VF set to promiscuous mode.
  • the VLAN sub-interface is a virtual bridge and has the capability of Layer 2 forwarding.
  • the first virtual machine sends a data packet to the second virtual machine, which is communication between two virtual machines inside the same host.
  • the second virtual machine and the first virtual machine may also be located on different hosts, and the first virtual machine and the second virtual machine communicate with each other.
  • the embodiment of the present invention describes the processing flow of the data packet by sending the data packet to the second virtual machine by using the first virtual machine, and the first virtual machine is connected to itself.
  • the VF sends a data packet to the second virtual machine, where the data packet carries the data packet
  • the VLAN identifier of the VF the switching device of the first network port receives the data packet, and the data packet is forcibly forwarded to the second network port by using the network cable; Determining, by the VLAN identifier, the data packet, the data packet is sent to a VLAN sub-interface having the same VLAN identifier as the data packet; the VLAN sub-interface receives the data packet, and removes the VLAN identifier of the data packet,
  • the data packet is sent to the virtual network function module, and after the virtual network function module performs network function processing on the modified data packet, the processed data packet is sent to the second virtual machine.
  • the data packet can be sent to the virtual network function module in the VMM through the above manner, and the software module is used to provide the user with rich virtual network functions. Perform virtual network function processing on data packets.
  • FIG. 3 is a schematic diagram of a process for creating a virtual machine according to an embodiment of the present invention, which is used to create a virtual machine with a pass-through VF and create a VLAN sub-interface corresponding to the pass-through VF.
  • Step 301 The computing management module receives a virtual machine creation request, where the virtual machine creation request is used to create a virtual machine with a through VF.
  • the creation process of the virtual machine can be initiated by the administrator or the user.
  • the administrator or the user logs in to the external interface of the cloud management platform through the terminal, selects the specifications of the virtual machine to be created, and initiates a virtual machine to the computing management module.
  • Creating a request the virtual machine creation request carrying a parameter of the virtual machine to be created, where the parameter includes indication information that the virtual machine to be created has a through VF;
  • Step 302 The calculation management module sends an allocation request to the device management module, and requests to allocate a VF to the virtual machine to be created.
  • Step 303 The device management module returns an identifier of the idle VF to the computing management module to the computing management module, where the free VF is a VF that has not been allocated to the virtual machine on the host;
  • Step 304 The calculation management module allocates a VLAN identifier to the VF.
  • Step 305 The calculation management module sends the VLAN identifier to the device management module, and the device management module configures the VLAN identifier to the allocated VF.
  • Step 306 The device management module sends information for creating a virtual machine to the VMM, where the The information of the virtual machine is included in the VF identifier.
  • Step 306 The VMM creates a virtual machine, and sets the VF as a direct network port of the virtual machine.
  • Step 307 After the virtual machine is successfully created, the computing management module sends a VLAN sub-interface creation request to the device management module, where the VLAN sub-interface creation request carries the VLAN identifier of the VF.
  • Step 308 The device management module receives the VLAN sub-interface creation request, and creates a VLAN sub-interface corresponding to the VF on the VMM, and configures the VLAN identifier of the VLAN sub-interface to be the same as the VF.
  • VLAN sub-interface is a virtual network device provided by the Linux system, and can be directly created through the ip command of the Linux system. For example, create a VLAN sub-interface with the VLAN ID of 100 as follows: ip link add link eth0 name vlan100 type vlan id 100
  • Step 309 The computing management module receives the VLAN sub-interface creation response message, sends a notification message to the network management module, and connects the created VLAN sub-interface to the bridge corresponding to the virtual network management module.
  • a virtual machine may have multiple pass-through VFs.
  • the specific creation process is similar to the above steps, but each pass-through VF is set with a different VLAN identifier and is created on the VMM with each pass-through VF. Corresponding VLAN subinterface.
  • FIG. 4 is a schematic flowchart of a method for processing a packet in a cloud computing system according to an embodiment of the present invention.
  • a first virtual machine on the host A communicates with a second virtual machine on the host B.
  • a second virtual machine on the host B communicates with a second virtual machine on the host B.
  • Step 401 The first virtual machine on the host A sends a data packet by using a VF connected to itself, the destination address of the data packet is an address of the second virtual machine, and the data packet carries the VF that sends the data packet.
  • VLAN identifier VLAN identifier
  • Step 402 The switching device (the first switching device) of the direct-through network port broadcasts the received data packet after receiving the data packet. Since the VLAN identifiers of the VFs on the direct-through network port are different, each VF is located in a different virtual local area network. The other VFs on the direct network port will not receive the broadcasted data, and the data packet is forcibly sent to the bypass network port through the network cable;
  • the direct network port and the bypass network port are in a virtual Ethernet port aggregation (VEPA) mode, and the VEPA mode is used to indicate a through network port.
  • VEPA virtual Ethernet port aggregation
  • the received network packet is forcibly forwarded by the network port and the VEPA mode is defined by the IEEE802.1Qbg standard.
  • Step 403 The switching device (the second switching device) of the bypass network port receives the data packet from the direct network port, and sends the data packet to the VMM to have the same VLAN identifier according to the VLAN identifier carried in the data packet.
  • VLAN subinterface
  • Step 404 The VLAN sub-interface receives the data packet, removes the VLAN identifier of the data packet, and sends the data packet to the first virtual network function module.
  • Step 405 After the first virtual network function module performs network function processing on the data packet, the data packet is sent to the service network port, and the service network port of the host A sends the received data packet to the host A. The network packet is routed to the service network port of the host B where the second virtual machine is located. After receiving the data packet, the service network port of the host B sends the data packet to the virtual network function of the host B. Module.
  • a tunnel may be established between the first virtual network function module of the host A and the second virtual network function module of the host B, and the data packet is transmitted to the host B through the network between the host A and the host B through the tunnel technology.
  • Virtual network function module may be established between the first virtual network function module of the host A and the second virtual network function module of the host B, and the data packet is transmitted to the host B through the network between the host A and the host B through the tunnel technology.
  • Step 406 After the network function is processed by the second virtual network function module on the host B, the data packet is sent to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, where the second virtual machine is connected.
  • the VF has the same VLAN identifier as the VLAN subinterface that receives the packet.
  • the VLAN sub-interface is connected to the virtual bridge implemented by the software, and the virtual bridge provides the Layer 2 forwarding capability to send the data packet to the VLAN sub-interface. Since the VLAN sub-interface and the corresponding VF are set to the same VLAN identifier, the VF that passes through to the second virtual machine can receive the data packet.
  • Step 407 The VLAN sub-interface adds a VLAN identifier to the data packet, where the VLAN identifier is a VLAN identifier of the VLAN sub-interface, and the data packet is sent to the bypass network port, because each VLAN connected to the network port is connected.
  • the sub-interfaces have different VLAN identifiers. Therefore, the switching device (the fourth switching device) of the bypass network port forwards the data packet to the through-network port through the network cable.
  • Step 408 The switching device (the third switching device) of the direct network port carries the packet according to the data packet.
  • the VLAN identifier of the band, the data packet is sent to the VF of the VLAN identifier identifier;
  • Step 409 The VF removes the VLAN identifier of the data packet, and sends the data packet to the second virtual machine.
  • the direct network port, the bypass network port, and the service network port may be located on the same network card, or may be separately located on different network cards, which is not limited in this embodiment of the present invention. Further, when the direct network port and the bypass network port are located on the same network card, the direct network card and the bypass network card may each have independent switching devices, or the direct network port and the bypass network port share the same switching device.
  • VLAN sub-interface in the embodiment of the present invention may be OpenVswitch.
  • each VF of the through-network port has a different VLAN identifier
  • the VMM has a VLAN sub-interface corresponding to the VF of the through-network port, and each VLAN sub-interface has the same VLAN identifier as the corresponding VF.
  • the switching device sends the data packet to the VLAN sub-interface with the same VLAN identifier according to the VLAN identifier carried in the data packet, so that the data packet is sent to the VMM, and then the virtual machine network function module in the VMM performs network function processing and is processed.
  • the subsequent packet is sent to the second virtual machine.
  • the data packet is sent to the virtual network function module in the VMM, and the software is used to realize the flexibility of the network function and provide rich network functions.
  • FIG. 4 shows a data packet transmission process between two virtual machines on two hosts. It can be understood by those skilled in the art that the source virtual machine and the destination virtual machine of the data packet can be located on the same host. .
  • the processed data packet is sent to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, and the VLAN sub-interface is adopted through the VLAN sub-interface. The packet is sent to the second virtual machine.
  • the host and cloud management platform can use general-purpose computer equipment, for example,
  • FIG. 5 is a schematic structural diagram of a hardware of a computer device according to an embodiment of the present invention.
  • the computer device 500 includes at least one processor 501, a communication bus 502, a memory 503, and at least one pass Letter interface 504.
  • Processor 501 can be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • Communication bus 502 can include a path for communicating information between the components described above.
  • the communication interface 504 uses devices such as any transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), and the like.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the memory 503 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • the memory can exist independently and be connected to the processor via a bus.
  • the memory can also be integrated with the processor.
  • the memory 503 is used to store application code for executing the solution of the present invention, and is controlled by the processor 501 for execution.
  • the processor 501 is configured to execute application code stored in the memory 503.
  • the processor 501 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • computer device 500 can include multiple processors, such as processor 501 and processor 508 in FIG. Each of these processors can be a single-CPU processor or a multi-core processor.
  • processors can be a single-CPU processor or a multi-core processor.
  • a processor can refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • computer device 500 may also include an output device 505 and an input device 506 as an embodiment.
  • Output device 505 is in communication with processor 501 and can display information in a variety of ways.
  • the output device 505 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 506 is in communication with processor 501 and can accept user input in a variety of ways.
  • input device 506 can be a mouse, keyboard, touch screen device, or sensing device, and the like.
  • the computer device 500 described above can be a general purpose computer device or a special purpose computer device.
  • the computer device 500 can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet, a wireless terminal device, a communication device, an embedded device, or have FIG. A device of similar structure.
  • Embodiments of the invention do not limit the type of computer device 500.
  • the cloud management platform and the host in FIG. 2 may be the device shown in FIG. 5, and the memory stores one or more software modules for implementing functions of the host and the cloud management platform.
  • the host and the cloud management platform can implement the packet processing method disclosed in the embodiment of the present invention by using the processor and the program code in the memory.
  • the computer device shown in FIG. 5 merely gives possible hardware implementations of various parts of the cloud computing system, and may add or delete hardware components of the computer device according to different functions or changes of various parts of the system. In order to match the functions of the various parts of the system.
  • the network card in the above embodiment includes a processor and a memory, and the processor in the network card executes instructions in the memory to implement the functions of the switching device.
  • the embodiments of the present invention are not described again.
  • the cloud computing system includes at least one host 601 and a cloud management platform 602.
  • the structure of the host 601 is as shown in FIG. 2.
  • the host 601 includes a virtual machine monitor VMM, and at least one network card.
  • the host 601 runs a first virtual machine, where the VMM includes multiple VLAN sub-interfaces and virtual network function modules, and the at least one network card includes an exchange.
  • the number of the VLAN sub-interfaces is the same as the number of the VFs of the first network port, and the number of the VLAN sub-interfaces is the same as the number of the VFs of the first network port.
  • the VLAN sub-interface and the corresponding VF have the same VLAN identifier
  • the first network port and the second network port are connected by a network cable.
  • the cloud management platform 602 is configured to create the first virtual machine on the host, and after the first virtual machine is successfully created, notify the VMM of the host to create a VF corresponding to the first virtual machine.
  • the VLAN sub-interface, the VLAN sub-interface corresponding to the VF of the first virtual machine and the VF of the first virtual machine have the same VLAN identifier;
  • the first virtual machine is configured to send, by using the VF connected to itself, a data packet to a second virtual machine, where the data packet carries a VLAN identifier of a VF that sends the data packet, and the second virtual machine address;
  • the switching device of the first network port is configured to receive the data packet, and forcibly forward the data packet to the second network port by using the network cable;
  • the switching device of the second network port is configured to receive a data packet from the first network port, and send the data packet to a VLAN that has the same VLAN identifier as the data packet according to the VLAN identifier carried in the data packet.
  • the VLAN sub-interface is configured to receive the data packet, remove a VLAN identifier of the data packet, and send the data packet to the virtual network function module.
  • the virtual network function module is configured to send the processed data packet after performing the network function processing on the modified data packet, and the destination address of the processed data packet is an address of the second virtual machine.
  • the embodiment of the present invention further provides a computer storage medium for storing the computer software instructions used in the foregoing apparatus of FIG. 2-6, which includes a program designed to execute the foregoing method embodiments. By executing the stored program, a method of processing a message in a cloud computing system can be implemented.
  • a packet processing method, a host, and a system in a cloud computing system according to an embodiment of the present invention are applied to a scenario in which a network card is directly connected.
  • the packet processing process disclosed in the embodiment of the present invention is used.
  • the data packet can be sent to the virtual network function module in the VMM, and the software module is used to provide users with rich network functions to implement network function processing on the data packet.
  • embodiments of the present invention can be provided as a method, apparatus (device), or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, embodiments of the invention may take the form of a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program is stored/distributed in a suitable medium, provided with other hardware or as part of the hardware, or in other distributed forms, such as over the Internet or other wired or wireless telecommunication systems.
  • the computer program instructions relating to the embodiments of the present invention may be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, and the functions of the components in the foregoing embodiments may be implemented by executing computer program instructions.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请的实施例提供了一种云计算系统中报文处理的方法、主机和系统，至少一个网卡连接到该主机，所述至少一个网卡包含交换设备以及至少三个网口，主机上运行的第一虚拟机通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，第一网口的交换设备接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口，第二网口的交换设备根据所述数据包携带的VLAN标识，将所述数据包发送到与所述数据包具备相同VLAN标识的VLAN子接口，所述VLAN子接口接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块，由所述虚拟网络功能模块对所述修改后的数据包进行网络功能处理后，将处理后的数据包发送到第二虚拟机。在网卡直通的场景中，虚拟机将数据包从直通的VF发出后，通过上述方式可以将数据包发送到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的虚拟网络功能，实现对数据包进行虚拟网络功能处理。

Description

云计算系统中报文处理的方法、主机和系统 技术领域
本发明涉及IT技术领域，尤其涉及云计算系统中报文处理的方法、主机和系统。
背景技术
虚拟化技术是云计算领域的关键技术之一，可将主机的物理资源抽象成共享资源池，供主机上运行的若干个虚拟机(Virtual Machine，VM)使用。主机上运行的若干个虚拟机可以共享使用主机的网卡，与主机外部网络进行通信。在现有技术中，可以通过网卡虚拟化的方式将网卡分配给虚拟机使用，网卡虚拟化可以采用单根输入输出虚拟化(Single-Root I/O Virtualization，SR-IOV)或或多根输入输出虚拟化(Multi Root Input/Output Virtualization，MR-IOV)，上述网卡虚拟化又称为网卡直通。以SR-IOV直通为例，当网卡支持SR-IOV时，使用SR-IOV技术可以将主机上网卡共享给主机上运行的若干个虚拟机。
在主机上使用支持SR-IOV能力的网卡时，网卡的网口会虚拟出至少一个物理功能(Physical Function,PF)以及多个虚拟功能(Virtual Function,VF)，主机上的虚拟机连接到至少一个VF。网卡内部包含具备交换机功能的交换设备。该交换设备按照介质访问控制(MediaAccessControl，MAC)表转发数据包，负责着PF、VF和物理网口之间的数据包转发，但由于该交换设备的处理和存储能力有限，因此无法为用户提供丰富的网络功能，例如安全组、服务质量(Quality of Service，QoS)、二层隧道封装以及分布式路由等等。
发明内容
本文描述了一种云计算系统中报文处理的方法、主机和系统以解决网卡直通场景下无法提供丰富的网络功能的问题。
第一方面，本发明实施例提供了一种主机，至少一个网卡连接到该主机， 所述主机上运行有虚拟机监视器VMM，VMM上运行有第一虚拟机，所述VMM包含多个VLAN子接口以及虚拟网络功能模块，所述至少一个网卡包含交换设备以及至少三个网口，其中，第一网口和第二网口支持网卡虚拟化能力，所述第一网口对应于至少一个物理功能PF和多个逻辑功能VF，所述多个VF配置有VLAN标识，且各VF的VLAN标识互不相同，所述第一虚拟机连接到所述第一网口的至少一个VF，所述VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，
所述第一虚拟机通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，所述第一网口的交换设备接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；所述第二网口的交换设备根据所述数据包携带的VLAN标识，将所述数据包发送到与所述数据包具备相同VLAN标识的VLAN子接口；所述VLAN子接口接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块，由所述虚拟网络功能模块对所述修改后的数据包进行网络功能处理后，将处理后的数据包发送到第二虚拟机。在网卡直通的场景中，虚拟机将数据包从直通的VF发出后，通过上述方式可以将数据包发送到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的网络功能，实现对数据包进行网络功能处理。
在一种可能的设计中，所述第一网口与所述第二网口的模式为虚拟以太网端口聚合VEPA模式。所述VEPA模式使得数据包可以在第一网口和第二网口之间进行强制转发。需要说明的是，VEPA模式仅是实现数据包强制转发其中一种方式，本领域技术人员可以采用其他的软件设置或者硬件设置以实现数据包强制转发，本发明实施例并不进行限定。
在一种可能的设计中，所述主机还包括设备管理模块，所述设备管理模块用于创建VLAN子接口。具体的：
所述设备管理模块，用于在第一虚拟机创建成功后，接收云管理平台发送的VLAN子接口创建请求，所述VLAN子接口创建请求携带分配给所述第一虚拟 机的VF的VLAN标识；
所述设备管理模块，还用于向VMM发送通知消息，用于通知所述VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识。
上述至少一个网卡包含至少三个网口，所述至少三个网口可以位于同一网卡或者不同网卡上。当第一网口和第二网口位于同一网卡上时，所述第一网口和所述第二网口可以共享网卡上的交换设备，也可以各自具备独立的交换设备。
在一种可能的设计中，数据包的源虚拟机(第一虚拟机)和目的虚拟机(第二虚拟机)位于同一主机上，所述虚拟网络功能模块将所述处理后的数据包发送到与所述第二虚拟机相连的VF对应的VLAN子接口，其中，所述第二虚拟机相连的VF与接收所述处理后的数据包的VLAN子接口具备相同的VLAN标识；与所述第二虚拟机相连的VF对应的VLAN子接口为所述数据包添加自身的VLAN标识，将所述数据包发送到第二网口；所述第二网口的交换设备，通过所述网线将所述数据包强制转发到第一网口；所述第一网口的交换设备根据所述数据包携带的VLAN标识，将所述数据包发送到所述数据包中的VLAN标识所标识的VF，从而使得所述数据包传输到第二虚拟机。
在一种可能的设计中，数据包的源虚拟机(第一虚拟机)和目的虚拟机(第二虚拟机)位于不同主机上，所述虚拟网络功能模块，具体用于建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模块之间的隧道，通过第三网口将所述处理后的数据包发送到外部的物理交换机，通过所述外部的物理交换机将所述处理后的数据包发送到第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第二虚拟机。
第二方面，与第一方面的装置相对应，本发明实施例还提供了一种云计算系统中报文处理的方法，所述云计算系统中的至少一个主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含多个VLAN子接口以及虚拟网络功能模块，所述至少一个网卡包含交换设备以及至少三个网口，其中，第一网口和第二网口支持网卡虚拟化能力，所述第一网口对 应于至少一个PF和多个VF，所述多个VF配置有VLAN标识，且各VF的VLAN标识互不相同，所述第一虚拟机连接到所述第一网口的至少一个VF，所述VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，所述方法包括：
所述第一虚拟机通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，以及所述第二虚拟机的地址；
所述第一网口的交换设备接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；
所述第二网口的交换设备接收来自第一网口的数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到所述VLAN标识所标识的VLAN子接口；
所述VLAN子接口接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块；
所述虚拟网络功能模块对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的地址为所述第二虚拟机的地址。
在一种可能的设计中，所述第一网口与所述第二网口的模式为VEPA模式。
在一种可能的设计中，所述方法还包括VLAN子接口创建流程，所述VLAN子接口创建流程包括：主机的设备管理模块在第一虚拟机创建成功后，接收云管理平台发送的VLAN子接口创建请求，所述VLAN子接口创建请求携带分配给所述第一虚拟机的VF的VLAN标识；所述设备管理模块向VMM发送通知消息，以使得所述VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识。
第三方面，本发明实施例提供了一种云计算系统，所述云计算系统包括云管理平台以及第一方面所述的主机，其中，所述云管理平台，用于在所述主机上创建所述第一虚拟机，在所述第一虚拟机创建成功后，通知所述主机的VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识。
第四方面，与前述装置、方法以及系统相对应，本发明实施例提供了一种主机，该主机具有实现第一方面中定义的主机的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。具体的，所述主机包括第一处理器、第一存储器以及至少一个网卡，所述网卡包含第二处理器、第二存储器以及至少两个网口，其中，所述至少一个网卡中的第一网口和第二网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述多个VF配置有VLAN标识，且各VF的VLAN标识互不相同，所述第一存储器和所述第二存储器中存储有指令，所述第一处理器执行所述第一存储器中的第一指令以实现第一虚拟机的功能，所述第一虚拟机连接到所述第一网口的至少一个VF，所述第一处理器执行所述第一存储器中的第二指令以实现VLAN子接口的功能，所述第一处理器执行所述第一存储器中的第三指令以实现虚拟网络功能模块的功能，所述第二处理器用于执行所述第二存储器中的指令以实现交换设备的功能，
所述第一虚拟机连接到所述第一网口的至少一个VF，所述主机中包含多个VLAN子接口，所述多个VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，
所述第一处理器用于执行所述第一存储器中的第一指令以执行步骤：通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，以及所述第二虚拟机的地址；
所述第二处理器用于执行所述第二存储器中的指令以执行步骤：用于接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；
所述第二处理器用于执行所述第二存储器中的指令以执行步骤：接收来自第一网口的数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到所述VLAN标识所标识的VLAN子接口；
所述第一处理器用于执行所述第一存储器中的第二指令以执行步骤：接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络 功能模块；
所述第一处理器用于执行所述第一存储器中的第三指令以执行步骤：对所述修改后的数据包进行网络功能处理后，根据所述所述第二虚拟机的地址将处理后的数据包发送到第二虚拟机。
在一个可能的设计中，所述主机和云管理平台由通用或专用的服务器实现，服务器的结构中包括处理器、存储器、系统总线以及输入输出接口，所述处理器被配置为支持所述系统中主机/云管理平台的相应的功能。所述输入输出接口用于与所述云计算系统中的其他部件进行通信，处理器执行所述存储器中存储的指令。
第五方面，本发明实施例提供了一种计算机存储介质，用于储存为上述主机所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第六方面，本发明实施例提供了另一种计算机存储介质，用于储存为上述网卡中的交换设备所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第七方面，本发明实施例提供了一种计算机程序，当物理服务器运行该计算机程序时，该物理服务器执行主机中虚拟机、VLAN子接口以及虚拟网络功能模块的功能。
第八方面，本发明实施例提供了一种计算机程序，当网卡中的处理器或可编程逻辑电路运行该计算机程序时，网卡执行前述方面中交换设备的功能。
综上，虚拟机将数据包从与虚拟机相连的VF发出，由第一网口的交换设备进行强制转发到第二网口，第二网口的交换设备根据数据包携带的VLAN标识将数据包发送给VMM上的VLAN子接口，通过该VLAN子接口将数据包传递到虚拟网络功能模块，由虚拟网络功能模块为该数据包提供丰富的网络功能处理。在网卡直通的基础上，虚拟机将数据包从直通的VF发出后，通过上述方式可以将数据包发送到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的网络功能，实现对数据包进行网络功能处理。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。显而易见地，下面附图中反映的仅仅是本发明的一部分实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得本发明的其他实施方式。而所有这些实施例或实施方式都在本发明的保护范围之内。
图1A是本发明实施例提供的主机上的虚拟化结构示意图；
图1B是本发明实施例提供的一种网卡直通场景下主机上的虚拟化结构示意图；
图2是本发明实施提供的另一种主机上的虚拟化架构示意图；
图3是本发明实施例提供的虚拟机的创建流程示意图；
图4是本发明实施例提供的云计算系统中报文的处理方法流程示意图；
图5是本发明实施例提供的一种计算机设备硬件结构示意图；
图6是本发明实施例提供的一种云计算系统结构示意图。
具体实施方式
本发明实施例描述的网络架构以及业务场景是为了更加清楚的说明本发明实施例的技术方案，并不构成对于本发明实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本发明实施例提供的技术方案对于类似的技术问题，同样适用。
如图1A所示，为本发明实施例提供的主机上的虚拟化结构示意图。主机为一台物理服务器，该物理服务器的底层为硬件层，硬件层主要包括中央处理器(CPU，Central Processing Unit)、内存、硬盘以及网卡等硬件资源。服务器虚拟化是在物理服务器上借助虚拟化软件(如VMWare ESX、Citrix XEN)实现多个虚拟机(Virtual Machine，VM)的虚拟化运行环境。安装在服务器上实现虚拟化环境的软件层被称为虚拟机监视器(Virtual MAChine Monitor,VMM)。运行在硬件层之上的VMM承担对硬件层中的硬件资源进行调度、分配和管理工作。VMM之上运行多个虚拟机VM，VMM为每个虚拟机提供虚拟化的CPU、内存、 存储、IO设备(如网卡)以及以太网交换机等硬件环境，保证多个虚拟机相互隔离运行。
在虚拟化运行环境中，VMM为每个虚拟机创建虚拟网卡(Virtual Network Interface Card，vNIC)，虚拟交换机VSwitch提供了虚拟机之间，以及虚拟机与外部网络之间的通讯能力。每个虚拟机的虚拟网卡对应到VSwitch的一个逻辑端口上，主机的物理网卡对应于VSwitch与外部物理交换机相连的端口。当虚拟机发送或接收的数据包经过VMM时，VMM中的虚拟网络功能模块对经过的数据进行网络功能处理，由于虚拟网络功能模块为软件模块，可以根据需要进行更新，因此，VMM中的虚拟网络功能模块可以为用户提供丰富的网络功能。
物理网卡的网口支持虚拟化能力可以通过单根输入输出虚拟化(Single Root Input/Output Virtualization，SR-IOV)或多根输入输出虚拟化(Multi Root Input/Output Virtualization，MR-IOV)来实现，本发明实施例以SR-IOV技术为例进行说明。SR-IOV技术是一种基于硬件的虚拟化解决方案，可以在虚拟机之间高效共享PCIe(Peripheral Component Interconnect Express，快速外设组件互连)设备，并且由于SR-IOV技术是在硬件中实现的，因此可以能够获得高效的I/O性能。
标准化组织PCI-SIG(Peripheral Component Interconnect Special Interest Group，外围设备互连专业组)定义了SR-IOV规范，SR-IOV规范可参阅http://www.pcisig.com。
通过使用SR-IOV技术，单个I/O资源可由主机上的多个虚拟机共享，这样，每个虚拟机都可访问同一个的硬件资源。因此，启用了SR-IOV的PCIe设备(例如物理网卡的网口)可以显示为多个单独的设备，显示出的每个单独的设备都具有独立的PCIe配置空间。以支持SR-IOV的物理网卡为例，该物理网卡上包含若干个网口，可以分别针对各个网口启用/禁用SR-IOV能力，启用了SR-IOV能力的网口对应于至少一个物理功能(Physical Function,PF)以及多个虚拟功能(Virtual Function,VF)，根据现有的SR-IOV规范，每个PF最多可有64,000个与其关联的VF。创建VF后，可以直接将VF指定给主机上 的虚拟机使用，从而使得多个虚拟机通过与其相连的至少一个VF共享PCIe设备。
如图1B所示，为本发明实施例提供的一种网卡直通场景下主机上的虚拟化结构示意图，与图1A不同的是，物理网卡支持单根IO虚拟化，物理网卡的一个网口对应于至少一个PF以及多个VF，各VF能共享物理网卡的物理资源(例如网卡端口)。
当主机上的虚拟机通过直通VF发送数据包时，虚拟机发出的数据包将会通过虚拟机上安装的VF驱动直接传递给网卡的VF，导致数据包无法经过VMM中的虚拟网络功能模块。由于网卡的交换设备中的MAC表容量有限，处理能力有限，且无法进行自由的功能扩展，因此网卡无法提供丰富的网络功能。在一种可能的场景中，交换设备为virtual ethernet bridge & classifier。
需要说明的是，本发明实施例针对网卡直通的场景，上述网卡直通的实现可以通过SR-IOV或者MR-IOV，本发明实施例对此并不进行限定。
如图2所示，为本发明实施提供的另一种主机上的虚拟化架构示意图，该主机包含VMM以及至少一个物理网卡，所述主机上运行有至少一个虚拟机。所述至少一个物理网卡包括至少三个网口，其中，第一网口和第二网口支持网卡虚拟化能力，第三网口连接到主机外部的物理交换机，负责发送和接收跨主机的网络流量。第一网口虚拟出至少一个PF以及至少两个VF(图2中以两个VF为例进行说明)，第一虚拟机和第二虚拟机上安装有VF驱动，第一虚拟机和第二虚拟机分别连接到至少一个VF,第一网口和第二网口通过网线直连，第二网口的PF连接到VMM上的VLAN子接口，因此，从虚拟机发出的流量，均会通过网线(networking cable)迂回到第二网口，由第二网口将流量引导回VMM中的虚拟网络功能模块。所述网线具体可以为各种介质的线缆，包括双绞线、光纤以及同轴电缆等等。本发明实施例通过网线将第一网口和第二网口的直连，从而将与第一网口的VF相连的虚拟机发出的数据包强制转发到第二网口，使得数据包传输路径必然经过VMM上的虚拟网络功能模块，从而实现在网卡直通的基础上，由VMM中的虚拟网络功能模块提供丰富的虚拟网络功能。
本领域技术人员可以理解的是，图2中仅以两个VF以及两个VLAN子接口为例，在实际产品实现时，支持网卡虚拟化功能的网卡可以虚拟化为至少一个PF以及多个VF，并不限定为两个，相对应得到VLAN子接口的数量也并不限定为两个。
在本发明各实施例中，网卡虚拟化具体是指网卡硬件虚拟化。
在本发明各实施例中，将第一网口称为直通网口，第二网口称为迂回网口，第三网口称为业务网口。
直通网口使用标准的SR-IOV/MR-IOV技术将VF直通给虚拟机，对不同的VF设置不同的虚拟局域网(Virtual Local Area Network，VLAN)标识，避免使用本网口的VF的多个虚拟机之间直接通信，强制虚拟机的数据包从网线发出。具体的，由于一个VLAN标识代表一个广播域，当不同的VF设置为不同的VLAN标识时，各个虚拟机连接的VF处在不同的广播域中，由于广播报文只能发送到处于一个VLAN内的虚拟机，所以，通过为每个VF设置的不同的VLAN标识，虚拟机发出的广播报文只能被虚拟机自身和PF收到。在设置VF的VLAN标识时，需要保证主机范围内VLAN标识唯一即可，不同主机上的VLAN标识可以相同。
在VMM上创建VLAN子接口，VLAN子接口的数量和直通网口的VF数量一致，且VLAN子接口的VLAN标识与直通网口上的VF的VLAN标识一一对应。迂回网口上与直通网口相连的网口可以是PF，也可以是设置为混杂模式(promiscuous mode)的VF。所述VLAN子接口为虚拟网桥，具备二层转发的能力。
需要说明的是，图2所示的实施例中，第一虚拟机向第二虚拟机发送数据包是同一主机内部的两个虚拟机之间的通信。本领域技术人员可以理解的是，第二虚拟机与第一虚拟机也可以位于不同主机上，此时第一虚拟机和第二虚拟机为跨主机通信。
结合图2所示的主机的虚拟化结构，本发明实施例以第一虚拟机发送数据包到第二虚拟机为例对数据包的处理流程进行说明，所述第一虚拟机通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的 VF的VLAN标识，所述第一网口的交换设备接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；所述第二网口的交换设备根据所述数据包携带的VLAN标识，将所述数据包发送到与所述数据包具备相同VLAN标识的VLAN子接口；所述VLAN子接口接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块，由所述虚拟网络功能模块对所述修改后的数据包进行网络功能处理后，将处理后的数据包发送到第二虚拟机。在网卡直通的场景中，虚拟机将数据包从直通的VF发出后，通过上述方式可以将数据包发送到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的虚拟网络功能，实现对数据包进行虚拟网络功能处理。
在上述第一虚拟机发送数据包到第二虚拟机的流程中，所述第一虚拟机连接的VF的VLAN标识与对应的VMM中的VLAN子接口的VLAN标识相同。如图3所示，为本发明实施例提供的一种虚拟机的创建流程示意图，用于创建具备直通VF的虚拟机以及创建与直通VF对应的VLAN子接口。
步骤301：计算管理模块接收虚拟机创建请求，所示虚拟机创建请求用于创建具备直通VF的虚拟机；
在一种场景中，虚拟机的创建流程可以由管理员或用户发起，管理员或者用户通过终端登录云管理平台对外呈现的界面，选择待创建的虚拟机的规格，向计算管理模块发起虚拟机创建请求，该虚拟机创建请求携带待创建的虚拟机的参数，所述参数包括待创建虚拟机具备直通VF的指示信息；
步骤302：计算管理模块向设备管理模块发送分配请求，请求为待创建的虚拟机分配VF；
步骤303：设备管理模块向计算管理模块返回空闲的VF的标识给所述计算管理模块，该空闲的VF即为主机上尚未分配给虚拟机的VF；
步骤304：计算管理模块为该VF分配VLAN标识；
步骤305：计算管理模块将所述VLAN标识发送给设备管理模块，设备管理模块将所述VLAN标识配置到分配的所述VF；
步骤306：设备管理模块将用于创建虚拟机的信息发送给VMM，所述用于创 建虚拟机的信息包含VF标识；
步骤306：VMM创建虚拟机，将所述VF设置为虚拟机的直通网口；
步骤307：虚拟机创建成功后，计算管理模块向设备管理模块发送VLAN子接口创建请求，所述VLAN子接口创建请求携带所述VF的VLAN标识；
步骤308：设备管理模块接收所述VLAN子接口创建请求，在VMM上创建与所述VF对应的VLAN子接口，配置所述VLAN子接口的VLAN标识与所述VF相同。
需要说明的是，VLAN子接口是linux系统提供的一种虚拟网络设备，可以直接通过linux系统的ip命令创建。实例性的，创建VLAN标识是100的VLAN子接口命令如下：ip link add link eth0 name vlan100 type vlan id 100
步骤309：计算管理模块接收VLAN子接口创建响应消息，向网络管理模块发送通知消息，将创建出的VLAN子接口连接到虚拟网络管理模块对应的网桥上。
需要说明的是，一个虚拟机可以具有多个直通VF，具体的创建过程与上述步骤类似，但每个直通VF均会被设置不同的VLAN标识，且在VMM上创建与每个直通VF一一对应的VLAN子接口。
如图4所示，为本发明实施例提供的一种云计算系统中报文的处理方法流程示意图，本发明实施例以主机A上的第一虚拟机向主机B上的第二虚拟机通信为例进行说明。
步骤401：主机A上的第一虚拟机通过与自身相连的VF发出数据包，所述数据包的目的地址为第二虚拟机的地址，所述数据包携带与发出所述数据包的VF的VLAN标识；
步骤402：直通网口的交换设备(第一交换设备)接收所述数据包后广播接收到的数据包，由于直通网口上各VF的VLAN标识各不相同，各VF位于不同的虚拟局域网，因此，直通网口上的其他VF不会接收到广播的所述数据，该数据包通过网线强制发送到迂回网口；
需要说明的是，所述直通网口和迂回网口为虚拟以太网端口聚合(Virtual Ethernet Port Aggregator，VEPA)模式，所述VEPA模式用于指示直通网口 和迂回网口对接收到的数据包进行强制转发，该VEPA模式由IEEE802.1Qbg标准定义。
步骤403：迂回网口的交换设备(第二交换设备)接收来自直通网口的所述数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到VMM上具备相同VLAN标识的VLAN子接口；
步骤404：所述VLAN子接口接收所述数据包，去除所述数据包的VLAN标识后，将数据包发送到第一虚拟网络功能模块；
步骤405：所述第一虚拟网络功能模块对所述数据包进行网络功能处理后，将所述数据包发送到业务网口，主机A的业务网口将接收到的数据包发送到主机A外部的网络，所述数据包路由到第二虚拟机所在的主机B的业务网口，所述主机B的业务网口在接收到所述数据包后，将数据包发送到主机B的虚拟网络功能模块。
具体的，可以在主机A的第一虚拟网络功能模块与主机B的第二虚拟网络功能模块之间建立隧道，通过隧道技术使得数据包经过主机A与主机B之间的网络传递到主机B的虚拟网络功能模块。
步骤406：由主机B上的第二虚拟网络功能模块进行网络功能处理后，将数据包发送到与所述第二虚拟机相连的VF对应的VLAN子接口，其中，所述第二虚拟机相连的VF与接收所述数据包的VLAN子接口具备相同的VLAN标识。
需要说明的是，在一种可能的场景中，VLAN子接口连接在软件实现的虚拟网桥上，由虚拟网桥提供二层转发能力，将数据包发送给VLAN子接口。由于VLAN子接口和对应的VF设置的是相同的VLAN标识，所以直通给第二虚拟机的VF可以接受到数据包。
步骤407：所述VLAN子接口为所述数据包添加VLAN标识，所述VLAN标识为所述VLAN子接口的VLAN标识，将所述数据包发送到迂回网口，由于迂回网口连接的各VLAN子接口具备不同的VLAN标识，因此，所述迂回网口的交换设备(第四交换设备)将该数据包经过网线强制转发到直通网口；
步骤408：所述直通网口的交换设备(第三交换设备)根据所述数据包携 带的VLAN标识，将所述数据包发送到所述VLAN标识标识的VF；
步骤409：所述VF去除所述数据包的VLAN标识，将所述数据包发送到第二虚拟机。
需要说明的是，在本发明实施例中，直通网口、迂回网口和业务网口可以处在同一网卡上，也可以单独位于不同的网卡上，本发明实施例对此并不进行限定。进一步的，当直通网口和迂回网口位于同一网卡上时，直通网卡和迂回网卡可以各自拥有独立的交换设备，或者，直通网口和迂回网口共享同一交换设备。
需要说明的是，在一种具体的实施场景中，本发明实施例中的VLAN子接口可以为OpenVswitch.
本发明实施例中，直通网口的各个VF具备不同的VLAN标识，VMM上设置有与直通网口的VF一一对应的VLAN子接口，每个VLAN子接口与对应的VF具备相同的VLAN标识，虚拟机将数据包从VF发出后，所述数据包携带VF的VLAN标识，由于直通网口与迂回网口直接通过网线相连，数据包会强制转发到迂回网口的交换设备，迂回网口的交换设备根据数据包携带的VLAN标识将数据包发送到具备相同VLAN标识的VLAN子接口，从而使得数据包发送到VMM，进而由VMM中的虚拟机网络功能模块进行网络功能处理，将经过处理后的数据包发送到第二虚拟机。通过上述方式，在网卡直通的场景下，将数据包发送到VMM中的虚拟网络功能模块，利用软件实现网络功能的灵活性，提供丰富的网络功能。
图4对应的实施例给出了两个主机上的两个虚拟机之间的数据包传输流程，本领域技术人员可以理解的是，数据包的源虚拟机和目的虚拟机可以位于同一主机上。此时，当主机上的虚拟网络功能模块针对所述数据包进行网络功能处理后，将处理后的数据包发送给与第二虚拟机相连的VF对应的VLAN子接口，通过该VLAN子接口将数据包发送到第二虚拟机。
主机、云管理平台可以采用通用的计算机设备，示例性的，
如图5所示，为本发明实施例提供的计算机设备硬件结构示意图。计算机设备500包括至少一个处理器501，通信总线502，存储器503以及至少一个通 信接口504。
处理器501可以是一个通用中央处理器(CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本发明方案程序执行的集成电路。
通信总线502可包括一通路，在上述组件之间传送信息。所述通信接口504，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。
存储器503可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，所述存储器503用于存储执行本发明方案的应用程序代码，并由处理器501来控制执行。所述处理器501用于执行所述存储器503中存储的应用程序代码。
在具体实现中，作为一种实施例，处理器501可以包括一个或多个CPU，例如图5中的CPU0和CPU1。
在具体实现中，作为一种实施例，计算机设备500可以包括多个处理器，例如图5中的处理器501和处理器508。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处 理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，计算机设备500还可以包括输出设备505和输入设备506。输出设备505和处理器501通信，可以以多种方式来显示信息。例如，输出设备505可以是液晶显示器(liquid crystal display，LCD),发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备506和处理器501通信，可以以多种方式接受用户的输入。例如，输入设备506可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的计算机设备500可以是一个通用计算机设备或者是一个专用计算机设备。在具体实现中，计算机设备500可以是台式机、便携式电脑、网络服务器、掌上电脑(Personal Digital Assistant，PDA)、移动手机、平板电脑、无线终端设备、通信设备、嵌入式设备或有图5中类似结构的设备。本发明实施例不限定计算机设备500的类型。
云管理平台和图2中的主机可以为图5所示的设备，存储器中存储了一个或多个软件模块，用于实现主机和云管理平台的各项功能。主机和云管理平台可以通过处理器以及存储器中的程序代码来实现本发明实施例公开的报文处理的方法。
需要说明的是，图5所示的计算机设备仅仅是给出了云计算系统中各部分的可能的硬件实现方式，根据系统各部分功能的不同或者变化，可以对计算机设备的硬件组件进行增删，以使得与系统各部分的功能进行匹配。
进一步的，与图5所示的硬件装置类似，上述实施例中的网卡中包含处理器以及存储器，网卡中的处理器执行存储器中的指令以实现上述交换设备的功能。本发明实施例不再赘述。
更进一步的，如图6所示，为本发明实施例提供的一种云计算系统结构示 意图，所述云计算系统包括至少一个主机601以及云管理平台602，所述主机601的结构如图2所示。
所述主机601包括虚拟机监视器VMM，以及至少一个网卡，所述主机601上运行有第一虚拟机，所述VMM包含多个VLAN子接口以及虚拟网络功能模块，所述至少一个网卡包含交换设备以及至少三个网口，其中，第一网口和第二网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述多个VF配置有VLAN标识，且各VF的VLAN标识互不相同，所述第一虚拟机连接到所述第一网口的至少一个VF，所述VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，
所述云管理平台602，用于在所述主机上创建所述第一虚拟机，在所述第一虚拟机创建成功后，通知所述主机的VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识；
所述第一虚拟机，用于通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，以及所述第二虚拟机的地址；
所述第一网口的交换设备，用于接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；
所述第二网口的交换设备，用于接收来自第一网口的数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到与所述数据包具备相同VLAN标识的VLAN子接口；
所述VLAN子接口，用于接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块；
所述虚拟网络功能模块，用于对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的地址为所述第二虚拟机的地址。
本发明实施例还提供了一种计算机存储介质，用于储存为上述图2-6中的设备所用的计算机软件指令，其包含用于执行上述方法实施例所设计的程序。通过执行存储的程序，可以实现云计算系统中报文处理的方法。
本发明实施例提供的云计算系统中报文处理的方法，主机和系统，应用于网卡直通的场景，虚拟机将数据包从直通的VF发出后，通过本发明实施例公开的报文处理流程，可以将数据包发送到VMM中的虚拟网络功能模块，利用该软件模块为用户提供丰富的网络功能，实现对数据包进行网络功能处理。
尽管在此结合各实施例对本发明进行了描述，然而，在实施所要求保护的本发明实施例过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
本领域技术人员应明白，本发明的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。计算机程序存储/分布在合适的介质中，与其它硬件一起提供或作为硬件的一部分，也可以采用其他分布形式，如通过Internet或其它有线或无线电信系统。
本发明实施例涉及到的计算机程序指令可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，通过执行计算机程序指令可以实现前述各实施例中各部件的功能
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个 流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管结合具体特征及其实施例对本发明进行了描述，显而易见的，在不脱离本发明的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本发明的示例性说明，且视为已覆盖本发明范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (20)

  1. 一种主机，其特征在于，所述主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含多个VLAN子接口以及虚拟网络功能模块，所述至少一个网卡包含交换设备以及至少三个网口，其中，第一网口和第二网口支持网卡虚拟化能力，所述第一网口对应于至少一个物理功能PF和多个虚拟功能VF，所述多个VF配置有虚拟局域网VLAN标识，且各VF的VLAN标识互不相同，所述第一虚拟机连接到所述第一网口的至少一个VF，所述VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，
    所述第一虚拟机，用于通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，以及所述第二虚拟机的地址；
    所述第一网口的交换设备，用于接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；
    所述第二网口的交换设备，用于接收来自第一网口的数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到所述VLAN标识所标识的VLAN子接口；
    所述VLAN子接口，用于接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块；
    所述虚拟网络功能模块，用于对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的地址为所述第二虚拟机的地址。
  2. 如权利要求1所述的主机，其特征在于，所述第一网口与所述第二网口的模式为虚拟以太网端口聚合VEPA模式。
  3. 如权利要求1或2述的主机，其特征在于，所述主机还包括设备管理模块，
    所述设备管理模块，用于在第一虚拟机创建成功后，接收云管理平台发送的VLAN子接口创建请求，所述VLAN子接口创建请求携带分配给所述第一虚拟机的VF的VLAN标识；
    所述设备管理模块，还用于向VMM发送通知消息，用于通知所述VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识。
  4. 如权利要求1-3任一所述的主机，其特征在于，
    所述第一网口、第二网口以及第三网口位于同一网卡上；或者，
    所述第一网口、第二网口以及第三网口位于两个或三个网卡上；或者，
    所述第一网口与所述第二网口位于同一网卡上，所述第一网口和所述第二网口共享所述同一网卡的交换设备；或者，
    所述第一网口与所述第二网口位于同一网卡上，所述第一网口的交换设备与所述第二网口的交换设备相互独立。
  5. 如权利要求1-4任一所述的主机，其特征在于，所述第二虚拟机与所述第一虚拟机位于同一主机。
  6. 如权利要求5所述的主机，其特征在于，
    所述虚拟网络功能模块，还用于将所述处理后的数据包发送到与所述第二虚拟机相连的VF对应的VLAN子接口，其中，所述第二虚拟机相连的VF与接收所述处理后的数据包的VLAN子接口具备相同的VLAN标识；
    与所述第二虚拟机相连的VF对应的VLAN子接口，用于为所述数据包添加自身的VLAN标识，将所述数据包发送到第二网口；
    所述第二网口的交换设备，还用于通过所述网线将所述数据包强制转发到第一网口；
    所述第一网口的交换设备，还用于根据所述数据包携带的VLAN标识，将所述数据包发送到所述数据包中的VLAN标识所标识的VF，从而使得所述数据包传输到第二虚拟机。
  7. 如权利要求1-4任一所述的主机，其特征在于，所述第二虚拟机与所述 第一虚拟机位于不同主机，
    所述虚拟网络功能模块，具体用于建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模块之间的隧道，通过第三网口将所述处理后的数据包发送到外部的物理交换机，通过所述外部的物理交换机将所述处理后的数据包发送到第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第二虚拟机。
  8. 一种云计算系统中报文处理的方法，其特征在于，所述云计算系统中的至少一个主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含多个VLAN子接口以及虚拟网络功能模块，所述至少一个网卡包含交换设备以及至少三个网口，其中，第一网口和第二网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述多个VF配置有VLAN标识，且各VF的VLAN标识互不相同，所述第一虚拟机连接到所述第一网口的至少一个VF，所述VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，所述方法包括：
    所述第一虚拟机通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，以及所述第二虚拟机的地址；
    所述第一网口的交换设备接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；
    所述第二网口的交换设备接收来自第一网口的数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到所述VLAN标识所标识的VLAN子接口；
    所述VLAN子接口接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块；
    所述虚拟网络功能模块对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的地址为所述第二虚拟机的地址。
  9. 如权利要求8所述的方法，其特征在于，所述第一网口与所述第二网口 的模式为VEPA模式。
  10. 如权利要求8或9所述的方法，其特征在于，所述主机还包括设备管理模块，所述方法还包括：
    所述设备管理模块在第一虚拟机创建成功后，接收云管理平台发送的VLAN子接口创建请求，所述VLAN子接口创建请求携带分配给所述第一虚拟机的VF的VLAN标识；
    所述设备管理模块向VMM发送通知消息，以使得所述VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识。
  11. 如权利要求8-10任一所述的方法，其特征在于，
    所述第一网口、第二网口以及第三网口位于同一网卡上；或者，
    所述第一网口、第二网口以及第三网口位于两个或三个网卡上；或者，
    所述第一网口与所述第二网口位于同一网卡上，所述第一网口和所述第二网口共享所述同一网卡的交换设备；或者，
    所述第一网口与所述第二网口位于同一网卡上，所述第一网口的交换设备与所述第二网口的交换设备相互独立。
  12. 如权利要求8-11任一所述的方法，其特征在于，所述第二虚拟机与所述第一虚拟机位于同一主机。
  13. 如权利要求12所述的方法，其特征在于，所述将处理后的数据包发送到第二虚拟机包括：
    所述虚拟网络功能模块将所述处理后的数据包发送到与所述第二虚拟机相连的VF对应的VLAN子接口，其中，所述第二虚拟机相连的VF与接收所述处理后的数据包的VLAN子接口具备相同的VLAN标识；
    与所述第二虚拟机相连的VF对应的VLAN子接口为所述处理后的数据包添加自身的VLAN标识，将所述处理后的数据包发送到第二网口；
    所述第二网口的交换设备通过所述网线将所述处理后的数据包强制转发到第一网口；
    所述第一网口的交换设备根据所述处理后的数据包携带的VLAN标识，将所述数据包发送到所述数据包中的VLAN标识所标识的VF，从而使得所述数据包传输到第二虚拟机。
  14. 如权利要求8-11任一所述的方法，其特征在于，所述虚拟网络功能模块发送处理后的数据包方法还包括包括：
    所述虚拟网络功能模块建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模块之间的隧道，通过第三网口将所述处理后的数据包发送到外部的物理交换机，通过所述外部的物理交换机将所述处理后的数据包发送到第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第二虚拟机。
  15. 一种云计算系统，其特征在于，包括云管理平台和至少一个主机，所述主机包括虚拟机监视器VMM，以及至少一个网卡，所述主机上运行有第一虚拟机，所述VMM包含多个VLAN子接口以及虚拟网络功能模块，所述至少一个网卡包含交换设备以及至少三个网口，其中，第一网口和第二网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述多个VF配置有VLAN标识，且各VF的VLAN标识互不相同，所述第一虚拟机连接到所述第一网口的至少一个VF，所述VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，
    所述云管理平台，用于在所述主机上创建所述第一虚拟机，在所述第一虚拟机创建成功后，通知所述主机的VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识；
    所述第一虚拟机，用于通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据包的VF的VLAN标识，以及所述第二虚拟机的地址；
    所述第一网口的交换设备，用于接收所述数据包，将所述数据包通过所述 网线强制转发到所述第二网口；
    所述第二网口的交换设备，用于接收来自第一网口的数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到与所述数据包具备相同VLAN标识的VLAN子接口；
    所述VLAN子接口，用于接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块；
    所述虚拟网络功能模块，用于对所述修改后的数据包进行网络功能处理后，发送处理后的数据包，所述处理后的数据包的目的地址为所述第二虚拟机的地址。
  16. 如权利要求15所述的系统，其特征在于，所述第一网口与所述第二网口的模式为VEPA模式。
  17. 如权利要求15或16所述的系统，其特征在于，所述主机还包括设备管理模块，
    所述设备管理模块，用于在第一虚拟机创建成功后，接收云管理平台发送的VLAN子接口创建请求，所述VLAN子接口创建请求携带分配给所述第一虚拟机的VF的VLAN标识；
    所述设备管理模块，还用于向VMM发送通知消息，用于通知所述VMM创建与所述第一虚拟机的VF对应的VLAN子接口，所述第一虚拟机的VF对应的VLAN子接口与所述第一虚拟机的VF具备相同的VLAN标识。
  18. 如权利要求15-17任一所述的系统，其特征在于，所述第二虚拟机与所述第一虚拟机位于同一主机，
    所述虚拟网络功能模块，还用于将所述处理后的数据包发送到与所述第二虚拟机相连的VF对应的VLAN子接口，其中，所述第二虚拟机相连的VF与接收所述处理后的数据包的VLAN子接口具备相同的VLAN标识；
    与所述第二虚拟机相连的VF对应的VLAN子接口，用于为所述数据包添加自身的VLAN标识，将所述数据包发送到第二网口；
    所述第二网口的交换设备，还用于通过所述网线将所述数据包强制转发到 第一网口；
    所述第一网口的交换设备，还用于根据所述数据包携带的VLAN标识，将所述数据包发送到所述数据包中的VLAN标识所标识的VF，从而使得所述数据包传输到第二虚拟机。
  19. 如权利要求15-17任一所述的系统，其特征在于，所述第二虚拟机与所述第一虚拟机位于不同主机，
    所述虚拟网络功能模块，具体用于建立与所述第二虚拟机所在的主机上的另一虚拟网络功能模块之间的隧道，通过第三网口将所述处理后的数据包发送到外部的物理交换机，通过所述外部的物理交换机将所述处理后的数据包发送到第二虚拟机所在的主机，以使得所述另一虚拟网络功能模块将所述处理后的数据包发送到所述第二虚拟机。
  20. 一种主机，其特征在于，包括第一处理器、第一存储器以及至少一个网卡，所述网卡包含第二处理器、第二存储器以及至少两个网口，其中，所述至少一个网卡中的第一网口和第二网口支持网卡虚拟化能力，所述第一网口对应于至少一个PF和多个VF，所述多个VF配置有VLAN标识，且各VF的VLAN标识互不相同，所述第一存储器和所述第二存储器中存储有指令，所述第一处理器执行所述第一存储器中的第一指令以实现第一虚拟机的功能，所述第一虚拟机连接到所述第一网口的至少一个VF，所述第一处理器执行所述第一存储器中的第二指令以实现VLAN子接口的功能，所述第一处理器执行所述第一存储器中的第三指令以实现虚拟网络功能模块的功能，所述第二处理器用于执行所述第二存储器中的指令以实现交换设备的功能，
    所述第一虚拟机连接到所述第一网口的至少一个VF，所述主机中包含多个VLAN子接口，所述多个VLAN子接口的数量与所述第一网口的VF的数量相同且一一对应，所述VLAN子接口与其对应的VF具备相同的VLAN标识，所述第一网口与所述第二网口通过网线相连，
    所述第一处理器用于执行所述第一存储器中的第一指令以执行步骤：通过与自身相连的所述VF向第二虚拟机发送数据包，所述数据包携带发出所述数据 包的VF的VLAN标识，以及所述第二虚拟机的地址；
    所述第二处理器用于执行所述第二存储器中的指令以执行步骤：用于接收所述数据包，将所述数据包通过所述网线强制转发到所述第二网口；
    所述第二处理器用于执行所述第二存储器中的指令以执行步骤：接收来自第一网口的数据包，根据所述数据包携带的VLAN标识，将所述数据包发送到所述VLAN标识所标识的VLAN子接口；
    所述第一处理器用于执行所述第一存储器中的第二指令以执行步骤：接收所述数据包，去除所述数据包的VLAN标识，将所述数据包发送到所述虚拟网络功能模块；
    所述第一处理器用于执行所述第一存储器中的第三指令以执行步骤：对所述修改后的数据包进行网络功能处理后，根据所述所述第二虚拟机的地址将处理后的数据包发送到第二虚拟机。
PCT/CN2016/105227 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统 WO2018086013A1 (zh)

Priority Applications (11)

Application Number Priority Date Filing Date Title
BR112018000362-0A BR112018000362A2 (pt) 2016-11-09 2016-11-09 método de processamento de pacote em sistema de computação em nuvem, hospedeiro e sistema
EP16909061.0A EP3343881B1 (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
PCT/CN2016/105227 WO2018086013A1 (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统
JP2017568237A JP6513835B2 (ja) 2016-11-09 2016-11-09 クラウドコンピューティングシステムにおけるパケット処理方法、ホスト、およびシステム
AU2016414391A AU2016414391B2 (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
CN201680009031.0A CN107278362B (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统
CN201910226607.4A CN110099014B (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法和主机
SG11201800101YA SG11201800101YA (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
CA2991208A CA2991208C (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
EP19188526.8A EP3654620B1 (en) 2016-11-09 2016-11-09 Packet processing method in cloud computing system, host, and system
US16/407,196 US10491517B2 (en) 2016-11-09 2019-05-09 Packet processing method in cloud computing system, host, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/105227 WO2018086013A1 (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/407,196 Continuation US10491517B2 (en) 2016-11-09 2019-05-09 Packet processing method in cloud computing system, host, and system

Publications (1)

Publication Number Publication Date
WO2018086013A1 true WO2018086013A1 (zh) 2018-05-17

Family

ID=60052231

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/105227 WO2018086013A1 (zh) 2016-11-09 2016-11-09 云计算系统中报文处理的方法、主机和系统

Country Status (9)

Country Link
US (1) US10491517B2 (zh)
EP (2) EP3654620B1 (zh)
JP (1) JP6513835B2 (zh)
CN (2) CN110099014B (zh)
AU (1) AU2016414391B2 (zh)
BR (1) BR112018000362A2 (zh)
CA (1) CA2991208C (zh)
SG (1) SG11201800101YA (zh)
WO (1) WO2018086013A1 (zh)

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3525423B1 (en) 2016-11-09 2021-04-07 Huawei Technologies Co., Ltd. Packet processing method in cloud computing system, host, and system
AU2016414391B2 (en) 2016-11-09 2019-01-17 Huawei Technologies Co., Ltd. Packet processing method in cloud computing system, host, and system
CN110088732B (zh) * 2016-12-19 2021-08-20 华为技术有限公司 一种数据包处理方法、主机和系统
CN110505110B (zh) * 2018-05-18 2021-07-20 杭州海康威视数字技术股份有限公司 网络接口的测试方法、装置及多网口主机
CN110519147A (zh) * 2018-05-22 2019-11-29 中兴通讯股份有限公司 数据帧传输方法、装置、设备和计算机可读存储介质
US11822946B2 (en) * 2018-06-28 2023-11-21 Cable Television Laboratories, Inc. Systems and methods for secure network management of virtual network functions
CN109525515B (zh) * 2018-10-23 2021-04-30 郑州云海信息技术有限公司 一种云平台中网卡的管理方法和装置
CN109617735B (zh) * 2018-12-26 2021-04-09 华为技术有限公司 云计算数据中心系统、网关、服务器及报文处理方法
CN109802855B (zh) * 2018-12-28 2020-08-07 华为技术有限公司 一种故障定位方法及装置
CN111698141B (zh) * 2019-03-13 2022-12-02 中兴通讯股份有限公司 报文的转发方法及装置
US11283732B2 (en) 2019-03-29 2022-03-22 Juniper Networks, Inc. Network functions virtualization (NFV) backplane on forwarding microchip
CN112152899B (zh) * 2019-06-28 2023-04-07 中兴通讯股份有限公司 一种基于网络切片的数据处理方法及装置
CN112468308A (zh) * 2019-09-06 2021-03-09 中兴通讯股份有限公司 虚拟局域网业务管理方法、虚拟局域网全局管理设备
US11237761B2 (en) 2019-11-01 2022-02-01 Microsoft Technology Licensing, Llc Management of multiple physical function nonvolatile memory devices
CN110912836B (zh) * 2019-11-14 2023-05-30 优刻得科技股份有限公司 使转发设备转发数据的方法、控制设备、存储介质和系统
CN111092876B (zh) * 2019-12-12 2021-10-01 北京首都在线科技股份有限公司 多主机系统、电子设备、存储介质、用于多主机系统的信息处理方法及装置
CN111367620B (zh) * 2020-03-06 2024-04-23 联想(北京)有限公司 一种虚拟网络实现方法及电子设备
CN111786909B (zh) * 2020-05-19 2022-04-29 深圳震有科技股份有限公司 一种更新vrrp接口的协议状态的方法、交换机及存储介质
CN114338606B (zh) * 2020-09-25 2023-07-18 华为云计算技术有限公司 一种公有云的网络配置方法及相关设备
DE102021113670A1 (de) * 2021-05-27 2022-12-01 Dspace Gmbh Verfahren zur Datenübertragung in einem Netzwerksystem sowie Netzwerksystem
CN113904938B (zh) * 2021-09-28 2022-04-29 北京大禹智芯科技有限公司 一种动态配置PCIe终端设备的系统和方法
CN114553899A (zh) * 2022-01-30 2022-05-27 阿里巴巴（中国）有限公司 一种存储设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101309180A (zh) * 2008-06-21 2008-11-19 华中科技大学 一种适用于虚拟机环境的安全网络入侵检测系统
US20130031233A1 (en) * 2011-07-29 2013-01-31 International Business Machines Corporation Network filtering in a virtualized environment
CN103051529A (zh) * 2012-12-20 2013-04-17 华为技术有限公司 一种报文的处理方法和装置
CN105978828A (zh) * 2016-05-16 2016-09-28 锐捷网络股份有限公司 一种实现虚拟机报文转发的方法和交换机

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8442048B2 (en) * 2009-11-04 2013-05-14 Juniper Networks, Inc. Methods and apparatus for configuring a virtual network switch
CN102457586B (zh) * 2010-10-18 2015-06-03 中兴通讯股份有限公司 一种实现二层网络的扩展方法及扩展的二层网络
US8533285B2 (en) * 2010-12-01 2013-09-10 Cisco Technology, Inc. Directing data flows in data centers with clustering services
CN102710432B (zh) * 2012-04-27 2015-04-15 北京云杉世纪网络科技有限公司 云计算数据中心中的虚拟网络管理系统及方法
US8964735B2 (en) 2012-05-18 2015-02-24 Rackspace Us, Inc. Translating media access control (MAC) addresses in a network hierarchy
US9059868B2 (en) * 2012-06-28 2015-06-16 Dell Products, Lp System and method for associating VLANs with virtual switch ports
CN102790777B (zh) * 2012-08-07 2016-06-15 华为技术有限公司 网络接口适配器注册方法及驱动设备、服务器
US9749240B2 (en) * 2012-10-24 2017-08-29 Nec Corporation Communication system, virtual machine server, virtual network management apparatus, network control method, and program
US10341263B2 (en) * 2012-12-10 2019-07-02 University Of Central Florida Research Foundation, Inc. System and method for routing network frames between virtual machines
JP6024474B2 (ja) * 2013-01-23 2016-11-16 富士通株式会社 マルチテナントシステム、管理装置、管理プログラム、およびマルチテナントシステムの制御方法
WO2014115157A1 (en) 2013-01-24 2014-07-31 Hewlett-Packard Development Comany, L.P. Address resolution in software-defined networks
WO2014161133A1 (zh) 2013-04-01 2014-10-09 华为技术有限公司 虚拟机的数据交换方法、装置和系统
CN103609077B (zh) 2013-06-18 2017-02-22 华为技术有限公司 用于数据传输的方法、装置和系统以及物理网卡
CN103346981B (zh) 2013-06-28 2016-08-10 华为技术有限公司 虚拟交换方法、相关装置和计算机系统
US9634948B2 (en) * 2013-11-07 2017-04-25 International Business Machines Corporation Management of addresses in virtual machines
CN103916314A (zh) 2013-12-26 2014-07-09 杭州华为数字技术有限公司 报文转发控制方法和相关装置及物理主机
CN103873374B (zh) * 2014-03-27 2017-08-11 新华三技术有限公司 虚拟化系统中的报文处理方法及装置
US9419897B2 (en) * 2014-06-30 2016-08-16 Nicira, Inc. Methods and systems for providing multi-tenancy support for Single Root I/O Virtualization
CN104125166B (zh) * 2014-07-31 2018-05-29 华为技术有限公司 一种队列调度方法及计算系统
CN105812340B (zh) 2014-12-31 2019-01-08 新华三技术有限公司 一种虚拟网络访问外网的方法和装置
US10812632B2 (en) * 2015-02-09 2020-10-20 Avago Technologies International Sales Pte. Limited Network interface controller with integrated network flow processing
AU2016414391B2 (en) 2016-11-09 2019-01-17 Huawei Technologies Co., Ltd. Packet processing method in cloud computing system, host, and system
EP3525423B1 (en) 2016-11-09 2021-04-07 Huawei Technologies Co., Ltd. Packet processing method in cloud computing system, host, and system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101309180A (zh) * 2008-06-21 2008-11-19 华中科技大学 一种适用于虚拟机环境的安全网络入侵检测系统
US20130031233A1 (en) * 2011-07-29 2013-01-31 International Business Machines Corporation Network filtering in a virtualized environment
CN103051529A (zh) * 2012-12-20 2013-04-17 华为技术有限公司 一种报文的处理方法和装置
CN105978828A (zh) * 2016-05-16 2016-09-28 锐捷网络股份有限公司 一种实现虚拟机报文转发的方法和交换机

Also Published As

Publication number Publication date
EP3654620A1 (en) 2020-05-20
EP3343881A1 (en) 2018-07-04
CN110099014B (zh) 2021-08-20
BR112018000362A2 (pt) 2018-09-11
JP2018537006A (ja) 2018-12-13
EP3343881B1 (en) 2019-08-14
CN110099014A (zh) 2019-08-06
SG11201800101YA (en) 2018-06-28
CN107278362B (zh) 2019-04-05
AU2016414391A1 (en) 2018-05-24
CA2991208C (en) 2020-07-28
JP6513835B2 (ja) 2019-05-15
EP3343881A4 (en) 2018-09-05
US20190280971A1 (en) 2019-09-12
US10491517B2 (en) 2019-11-26
AU2016414391B2 (en) 2019-01-17
EP3654620B1 (en) 2022-03-09
CA2991208A1 (en) 2018-05-09
CN107278362A (zh) 2017-10-20

Similar Documents

Publication Publication Date Title
WO2018086013A1 (zh) 云计算系统中报文处理的方法、主机和系统
US11005755B2 (en) Packet processing method in cloud computing system, host, and system
US11190375B2 (en) Data packet processing method, host, and system
US9031081B2 (en) Method and system for switching in a virtualized platform
US20100287262A1 (en) Method and system for guaranteed end-to-end data flows in a local networking domain
US9154451B2 (en) Systems and methods for sharing devices in a virtualization environment
EP3629162B1 (en) Technologies for control plane separation at a network interface controller
US9106529B2 (en) Virtual network configuration and management
US8792502B2 (en) Duplicate MAC address detection
EP4004721B1 (en) Computer device including process isolated containers with assigned virtual functions
WO2012168872A1 (en) Virtual network configuration and management
US10554552B2 (en) Monitoring network addresses and managing data transfer
Tholeti Hypervisors, Virtualization, and Networking

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2017568237

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 2991208

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: 11201800101Y

Country of ref document: SG

ENP Entry into the national phase

Ref document number: 2016414391

Country of ref document: AU

Date of ref document: 20161109

Kind code of ref document: A

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112018000362

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 112018000362

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20180108

NENP Non-entry into the national phase

Ref country code: DE