WO2022088743A1 - 一种流表处理方法及相关设备 - Google Patents

一种流表处理方法及相关设备 Download PDF

Info

Publication number
WO2022088743A1
WO2022088743A1 PCT/CN2021/104663 CN2021104663W WO2022088743A1 WO 2022088743 A1 WO2022088743 A1 WO 2022088743A1 CN 2021104663 W CN2021104663 W CN 2021104663W WO 2022088743 A1 WO2022088743 A1 WO 2022088743A1
Authority
WO
WIPO (PCT)
Prior art keywords
network interface
flow table
interface card
virtual
target
Prior art date
Application number
PCT/CN2021/104663
Other languages
English (en)
French (fr)
Inventor
李力军
周敬滨
李晓
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21884482.7A priority Critical patent/EP4228177A4/en
Publication of WO2022088743A1 publication Critical patent/WO2022088743A1/zh
Priority to US18/307,711 priority patent/US20230269182A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/70—Virtual switches
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/76—Routing in software-defined topologies, e.g. routing between virtual machines
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/24—Multipath
    • H04L45/245—Link aggregation, e.g. trunking
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/15—Interconnection of switching modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/30—Peripheral units, e.g. input or output ports
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/645—Splitting route computation layer and forwarding layer, e.g. routing according to path computational element [PCE] or based on OpenFlow functionality
    • H04L45/655—Interaction between route computation entities and forwarding entities, e.g. for route determination or for flow table update
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/12—Avoiding congestion; Recovering from congestion
    • H04L47/125—Avoiding congestion; Recovering from congestion by balancing the load, e.g. traffic engineering
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Definitions

  • the present invention relates to the field of communication technologies, and in particular, to a flow table processing method and related equipment.
  • a server or physical machine or host runs an operating system, the physical machine is connected to a physical switch, and the physical switch realizes data forwarding between different hosts.
  • a host is virtualized into multiple virtual machines (Virtual Machine, VM), and the virtual machines in the same host pass through a virtual switch (Virtual Switch, VSw), for example, through a virtual switch to realize data forwarding.
  • VM Virtual Machine
  • VSw Virtual Switch
  • At least the hardware resources on each physical machine need to support running multiple virtual machines and virtual switches.
  • the hardware resources of each physical machine are limited. If the virtual switch responsible for the data exchange task occupies too many hardware resources, it will easily affect the operation of the virtual machine on the physical machine, reduce work efficiency, and reduce the reliability of the physical machine. Defects such as slow processing speed may even lead to system failure due to the overburdened physical machine.
  • the virtual switch In order to reduce the occupation of the hardware resources of the physical machine, the virtual switch gradually goes through three stages: kernel-mode soft-switching, user-mode soft-switching, and hardware offload switching.
  • the hardware offload switching technology is gradually being used by mainstream manufacturers.
  • some I/O services in the host are offloaded to low-cost heterogeneous hardware for execution, which can release the central processing unit (CPU) resources in the host and improve the operating efficiency of the CPU.
  • CPU central processing unit
  • the matching operation of the flow table can be offloaded to the hardware, and then the matching operation of the flow table originally performed on the host can be offloaded to the hardware.
  • These heterogeneous hardware for offloading Input/Output (I/O) services include network interface cards, which may also be referred to as offloading cards.
  • network interface cards which may also be referred to as offloading cards.
  • there is a reliability problem across network interface cards in the hardware offload switching technology that is, the reliability of different links in a single network interface card can only be achieved. If the network interface card fails, the entire system will fail, and there is a single point of failure. risks of.
  • Embodiments of the present invention provide a flow table processing method and related equipment, so as to solve the problem of reliability across network interface cards existing in the hardware offload switching technology.
  • an embodiment of the present invention provides a flow table processing method.
  • the flow table processing method is applied to a virtual switch, where the virtual switch connects M virtual machines and N network interface cards, where M and N are greater than or equal to an integer of 2, the flow table processing method may include: establishing a mapping relationship between N port identifiers of N logical ports corresponding to the N network interface cards and a target port identifier, so as to convert the N logical ports Aggregate into a first port; wherein, the logical port corresponding to each network interface card is a logical port formed by aggregation of the physical ports of each network interface card based on the link aggregation control protocol LACP; the precise flow table is unloaded through the first port to the N network interface cards.
  • the first network interface card of the multiple network interface cards receives a broadcast packet (such as an Address Resolution Protocol (ARP) packet) that can only be processed based on the virtual switch
  • a broadcast packet such as an Address Resolution Protocol (ARP) packet
  • ARP Address Resolution Protocol
  • the packet It can be sent by the virtual machine to the first network interface card or sent by other physical machines to the first network interface card through the physical switch. Since there is no quintuple, the corresponding precise flow table cannot be unloaded.
  • the packet broadcast must be performed based on the virtual switch. Therefore, after receiving the ARP packet, the first network interface card will send the ARP packet to the virtual switch.
  • ARP Address Resolution Protocol
  • the first network interface card sends the ARP packet to the virtual machine via the logical link corresponding to the first network interface card.
  • the virtual switch will broadcast the ARP packet again through the logical link corresponding to the second network card. To the physical switch, so far the ARP packet generates a data loop between the virtual switch and the physical switch.
  • the virtual switch will The packet is broadcast to the physical switch through the logical link corresponding to the second network card. After receiving the ARP packet, the physical switch will broadcast the ARP packet to the virtual switch again through the logical link corresponding to the first network card. There is also a data loopback between the virtual switch and the physical switch. Data loopback between physical switches and virtual switches affects system performance and even causes abnormal packet processing.
  • the physical ports inside each network interface card are aggregated to form logical ports based on the link aggregation control protocol LACP to form a first-level binding;
  • the virtual switch establishes N of the N logical ports The mapping relationship between the port identifier and the target port identifier, so that the N logical ports corresponding to the N network interface cards are set to correspond to the same target port identifier to form a second-level binding.
  • the first port formed by the two-level binding in the embodiment of the present invention can avoid data loopback between the physical switch and the virtual switch that may be caused by the N logical ports corresponding to different port identifiers respectively.
  • the N port identifiers of the N logical ports correspond to the same target port identifier, so from the switch side, the N network interface cards correspond to one logical link, thereby avoiding different processing of similar ARP packets.
  • the virtual switch can switch to another network interface card, thereby ensuring the reliability of packet processing services.
  • the method before the unloading the precise flow table to the N network interface cards through the first port, the method further includes: receiving a message sent by the target network interface card, where the The message carries the message received by the target network interface card and the identifier of the virtual function for which the target network interface card received the message, and the message is that the target network interface card receives the message. It is sent after querying that the target network interface card does not have an offload flow table corresponding to the message, and the target network interface card is one of the N network interface cards; based on the report and the identifier of the virtual function to determine the precise flow table, where the precise flow table is used to indicate the processing of the packet.
  • the target network interface card sends a message to the virtual switch after receiving the message sent by the target virtual machine and after checking that there is no offload flow table corresponding to the message, the virtual switch determines according to the message the precise flow table, and when it is determined that the precise flow table satisfies the unloading condition, the precise flow table is unloaded to the N network interface cards through the first port, thereby, on the one hand, a virtual switch is implemented Execute software slow path rule learning on packets, support hardware offloading of virtual switches, and then support the rich service function demands of cloud computing platforms; on the other hand, virtual switches offload accurate flow tables to all network interface cards connected to the host. When any network interface card fails, the virtual switch can switch to other network interface cards, thereby ensuring the reliability of packet processing services.
  • the method before the receiving the message sent by the target network interface card, the method further includes: receiving the message sent by the target virtual machine through a second port, where the target virtual machine is the Any one of the M virtual machines, the second port is a logical port formed by aggregation of N virtual functions corresponding to the N network interface cards in the virtual switch; Determine the target virtual function among the N virtual functions; send the message to the target virtual function, so that the target network interface card corresponding to the target virtual function inquires whether there is a connection with the message according to the message The offload flow table corresponding to the text.
  • the working mode configuration of the virtual network card of the virtual machine may be set to the soft pass-through mode (the virtual machine passes through the virtual switch
  • the soft pass-through module is connected to the network interface card
  • the packets sent by the virtual machine can be transported to the target network interface card through the virtual switch, so as to realize the working mode of configuring the virtual network card according to the scene and requirements, and when the virtual network card hard pass-through fails, Switch to soft pass-through mode to continue packet transmission to ensure service reliability.
  • the method before the unloading the precise flow table to the N network interface cards through the first port, the method further includes: determining that the precise flow table satisfies an unloading condition, Wherein, the determining that the precise flow table satisfies the unloading condition includes: determining, according to the packet corresponding to the precise flow table, that the connection state between the virtual machine sending the packet and the virtual switch is stable; and/or according to the packet corresponding to the precise flow table The message corresponding to the precise flow table determines that the flow rate of the virtual machine that sends the message is greater than or equal to a preset threshold.
  • the storage space of the network interface card is limited, it is difficult to store a large number of offload flow tables. Only when the connection state between the virtual machine sending the message and the virtual switch is stable; and/or when it is determined according to the message that the flow rate of the virtual machine sending the message is greater than or equal to a preset threshold, the virtual switch will add the precise flow table Unloading to the network interface card prevents blind unloading from occupying the storage space of the network interface card and reduces the packet processing efficiency of the network interface card.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same.
  • the offload flow table stored in the network interface card can be linked to the precise flow table in the virtual switch according to the linked list technology.
  • the precise flow table in the virtual switch is deleted or changed, and when any network interface
  • the host will notify the network interface card to delete or modify the offload flow table synchronously, so as to realize the consistency management of all the offload flow tables stored in the network interface card and the precise flow table stored in the host.
  • the method further includes: when detecting that the target offload flow table stored in the first network interface card of the N network interface cards is deleted, sending a message to the N network interface cards
  • the other network interface cards other than the first network interface card send a deletion instruction, and the deletion instruction is used to instruct to delete the stored unloading flow table that is the same as the target unloading flow table, and the first network interface card is For any one of the N network interface cards, the target offload flow table is any one of multiple offload flow tables stored in the first network interface card.
  • the method further includes: when a preset condition is detected, sending an update instruction to the N network interface cards, where the update instruction is used to instruct the N network interface cards to update
  • the offload flow table associated with the target message the preset conditions include the change of the slow path forwarding rule corresponding to the target message, the aging of the connection of the target message, the deletion of the virtual machine port, and the change of the TCP connection state of the transmission control protocol one or more of.
  • N network interface cards are instructed to update the offload flow table associated with the target packet, so as to realize the synchronization of the precise flow table and the offload flow table and all Consistency management of offload flow tables stored in network interface cards.
  • the method further includes: when an abnormal state of the second network interface card among the N network interface cards is detected, releasing the logical port corresponding to the second network interface card from the Aggregation of logical ports corresponding to other network interface cards in the N network interface cards except the second network interface card, where the second network interface card is any one of the N network interface cards; sending a marking instruction to the second network interface card, and releasing the one-to-one correspondence between the offload flow table stored in the second network interface card and the precise flow table that meets the unloading condition included in the precise flow table set, The marking instruction is used to instruct the second network interface card to mark the stored offload flow table as invalid.
  • the offload flow table stored in the abnormal state of the network interface card is marked as invalid, and the set of the offload flow table and the precise flow table marked as invalid is cancelled.
  • the one-to-one correspondence of the precise flow tables that meet the unloading conditions included in the NIC and then release the association between the unloaded flow tables marked as invalid and the unloaded flow tables stored in other network interface cards, and realize the Offload consistency management for flow tables.
  • the method further includes: when the state of the second network interface card is normal, associating the logical port corresponding to the second network interface card with the logical port corresponding to the other network interface card Aggregation; unloading the precise flow table in the precise flow table set to the second network interface card, wherein the precise flow table unloaded to the second network interface card constitutes the offloading corresponding to the second network interface card A flow table set; establishing a one-to-one correspondence between the offload flow table included in the offload flow table set corresponding to the second network interface card and the precise flow table included in the precise flow table set that satisfies the offload condition.
  • the virtual function link corresponding to the network interface card and the setting of the related offload flow table are restored, thereby realizing the unloading flow table among multiple network interface cards. Unified management.
  • the method before the receiving the message sent by the target network interface card, the method further includes: receiving, through the second port, a data stream sent by the target virtual machine, where the data stream includes the data stream sent by the target virtual machine.
  • the packets included in the data flow match the same offload flow table, and the data flow is divided into K queues; send the data flow to N virtual functions corresponding to the N network interface cards , wherein each virtual function is responsible for the reception of data flows of K/N queues, so that the target network interface card queries whether there is an offload flow table corresponding to the message according to the data flows of K/N queues,
  • K is an integer multiple of N
  • the virtual network card of the target virtual machine is configured as K queues
  • the data flow is based on the correspondence between the K queues of the virtual network card and the N virtual functions by
  • the memory of the target virtual machine is directly copied to the memory of the N network interface cards to implement zero-copy transmission of the data stream from the target virtual machine to the N network interface cards.
  • the packets sent by the virtual machine are transported to all network interface cards through the virtual switch, and based on the K queues of the virtual network card and all network interface cards.
  • the corresponding relationship between the N virtual functions realizes zero copy of packet transmission, which improves the processing efficiency of packets on the one hand, and reduces unnecessary copies of the host on the other hand, releases CPU resources, and reduces memory usage.
  • an embodiment of the present invention provides a flow table processing method.
  • the flow table processing method is applied to a physical machine, where the physical machine includes a host and N network interface cards, and the host runs a virtual switch and a network interface card.
  • M virtual machines, the N network interface cards are connected to the host through the host interface, the N network interface cards are connected to the external network through the network interface, M and N are integers greater than or equal to 2, the flow table processing
  • the method may include: establishing, by the virtual switch, a mapping relationship between N port identifiers and target port identifiers of N logical ports corresponding to the N network interface cards, so as to aggregate the N logical ports into the No.
  • the logical port corresponding to each network interface card is a logical port formed by the aggregation of the physical ports of each network interface card based on the link aggregation control protocol LACP;
  • the target network interface card receives a message, and the message is related to the A message sent by a physical switch connected to a physical machine or sent by a target virtual machine, where the target virtual machine is any one of the M virtual machines, and the target network interface card is one of the N network interface cards.
  • the target network interface card finds that the target network interface card does not have an offload flow table corresponding to the packet, the virtual switch sends the packet to the first port through the first port.
  • the corresponding precise flow tables are offloaded to the N network interface cards.
  • the method further includes: when the target network interface card finds that there is no offload flow table corresponding to the message in the target network interface card, sending a request to the virtual switch Send a message, where the message carries the message and the identifier of the virtual function of the target network interface card to receive the message; the virtual switch determines based on the message and the identifier of the virtual function The exact flow table corresponding to the packet.
  • the method further includes: the target network interface card processes the packet based on the offloaded precise flow table.
  • the method further includes: when the target network interface card finds that there is an offload flow table corresponding to the message in the target network interface card, the target network interface card The packet is processed based on the offload flow table.
  • the method when the message is sent by the target virtual machine, the method further includes: the target virtual machine sending a message to the target network interface card; the target virtual machine Including a virtual network card, the working mode of the virtual network card includes a soft pass-through mode and a hard pass-through mode;
  • the target virtual machine sending the message to the target network interface card includes: when the working mode of the virtual network card of the target virtual machine is configured as a soft pass-through mode, the target virtual machine sends the message to the virtual switch.
  • the virtual switch receives the message sent by the target virtual machine through a second port, where the second port is formed by aggregation of N virtual functions corresponding to the N network interface cards in the virtual switch.
  • the virtual switch determines the target virtual function from the N virtual functions corresponding to the N network interface cards; the virtual switch sends the message to the target virtual function; in the target virtual function
  • the target virtual machine determines the target virtual function from the N virtual functions corresponding to the N network interface cards; the target virtual machine passes the third The port sends the message to the target virtual function, wherein the third port is a logical port formed by aggregation of the N virtual functions in the target virtual machine.
  • the method before the virtual switch unloads the precise flow table corresponding to the packet to the N network interface cards through the first port, the method further includes: the virtual switch Determining that the precise flow table corresponding to the message satisfies the unloading condition; wherein determining, by the virtual switch, that the precise flow table corresponding to the message satisfies the unloading condition includes: the virtual switch determining to send the message according to the message The connection state between the virtual machine of the message and the virtual switch is stable; and/or the virtual switch determines according to the message that the flow rate of the virtual machine that sends the message is greater than or equal to a preset threshold.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same.
  • the method further includes: when the virtual switch detects that the target offload flow table stored in the first network interface card of the N network interface cards is deleted, sending a message to the virtual switch to the The N network interface cards other than the first network interface card send a deletion instruction, where the deletion instruction is used to instruct to delete the stored offload flow table that is the same as the target offload flow table, and the first The network interface card is any one of the N network interface cards, and the target offload flow table is any one of multiple offload flow tables stored in the first network interface card.
  • the method further includes: when the virtual switch detects a preset condition, sending an update instruction to the N network interface cards, where the update instruction is used to instruct the N network interface cards
  • the network interface card updates the offload flow table associated with the target message
  • the preset conditions include the change of the slow-path forwarding rule corresponding to the target message, the aging of the connection of the target message, the deletion of the virtual machine port, and the transmission control protocol.
  • One or more of TCP connection state changes.
  • the method further includes: when the virtual switch detects that the state of the second network interface card among the N network interface cards is abnormal, releasing the corresponding state of the second network interface card Aggregation of logical ports and logical ports corresponding to other network interface cards in the N network interface cards except the second network interface card, where the second network interface card is any one of the N network interface cards A network interface card; the virtual switch sends a marking instruction to the second network interface card, and releases the offload flow table stored in the second network interface card and the precise flow table set that meets the offload condition.
  • the marking instruction is used to instruct the second network interface card to mark the stored offload flow table as invalid.
  • the method further includes: when the second network interface card is in a normal state, the virtual switch associates the logical port corresponding to the second network interface card with the other network interface card Corresponding logical port aggregation; the virtual switch unloads the precise flow table in the precise flow table set to the second network interface card, wherein the precise flow table unloaded to the second network interface card constitutes the an offload flow table set corresponding to the second network interface card; the virtual switch establishes the offload flow table set corresponding to the second network interface card and the offload flow table included in the set and the precise flow table set that satisfy the offload condition The one-to-one correspondence of the exact flow table.
  • the target virtual machine when the working mode of the virtual network card of the target virtual machine is configured as a soft pass-through mode, the target virtual machine sends a packet to the target network interface card, further comprising: the The target virtual machine configures the number of queues of the virtual network card to be K, and divides the data flow to be sent into K queues, wherein the data flow includes the message, and the message included in the data flow matches the same offload flow table ; the virtual switch receives the data stream sent by the target virtual machine through the second port; the virtual switch sends the data stream to N virtual functions corresponding to the N network interface cards, wherein , each virtual function is responsible for receiving the data flow of K/N queues, so that the target network interface card queries whether there is an offload flow table corresponding to the message according to the data flow of K/N queues, K is Integer multiple of N, the data flow is directly copied from the memory of the target virtual machine to the memory of the N network interface cards based on the correspondence between the K queues of the virtual network card
  • an embodiment of the present invention provides a flow table processing apparatus, the flow table processing apparatus is applied to a virtual switch, and the virtual switch connects M virtual machines and N network interface cards, where M and N are greater than or An integer equal to 2, characterized in that the apparatus includes: a first receiving unit, a determining unit and an unloading unit.
  • an establishment unit configured to establish a mapping relationship between N port identifiers and target port identifiers of N logical ports corresponding to the N network interface cards, so as to aggregate the N logical ports into a first port; wherein,
  • the logical port corresponding to each network interface card is a logical port formed by the aggregation of the physical ports of each network interface card based on the link aggregation control protocol LACP.
  • An offloading unit configured to offload the precise flow table to the N network interface cards through the first port.
  • the apparatus further includes: a first receiving unit, configured to receive a message sent by a target network interface card, where the message carries the message received by the target network interface card and the target The identifier of the virtual function that the network interface card receives the message, and the message is sent by the target network interface card after receiving the message and finding that there is no internal offload flow table corresponding to the message.
  • the target network interface card is one of the N network interface cards;
  • the determining unit is configured to determine the precise flow table based on the message and the identifier of the virtual function, the precise flow table The table is used to indicate the processing of the message.
  • the apparatus further includes: a second receiving unit, further configured to receive the message sent by a target virtual machine through a second port, where the target virtual machine is the M virtual machines Any one of the second ports is a logical port formed by aggregation of N virtual functions corresponding to the N network interface cards in the virtual switch; the determining unit is further configured to retrieve data from the N network interfaces. determining a target virtual function among the N virtual functions corresponding to the interface card; a sending unit, configured to send the message to the target virtual function, so that the target network interface card corresponding to the target virtual function The message queries whether there is an offload flow table corresponding to the message.
  • the unloading unit is further configured to determine that the precise flow table satisfies the unloading condition, and when used to determine that the precise flow table satisfies the unloading condition, the unloading unit is specifically configured to: It is determined according to the packet corresponding to the precise flow table that the connection state between the virtual machine that sends the packet and the virtual switch is stable; and/or the virtual machine that sends the packet is determined according to the packet corresponding to the precise flow table.
  • the flow rate of the machine is greater than or equal to the preset threshold.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offload flow tables included in each offload flow table set have a one-to-one correspondence with the precise flow tables included in the precise flow table set that satisfy the unloading conditions
  • the N offload flow tables in the N offload flow table sets correspond to the same precise flow table
  • the flow table is the same.
  • the apparatus further includes: a first update unit, configured to, when detecting that the target offload flow table stored in the first network interface card of the N network interface cards is deleted, Send a deletion instruction to the N network interface cards except the first network interface card, where the deletion instruction is used to instruct to delete the stored unloading flow table that is the same as the target unloading flow table, so
  • the first network interface card is any one of the N network interface cards
  • the target offload flow table is any one of a plurality of offload flow tables stored in the first network interface card.
  • the apparatus further includes: a second update unit, configured to send an update instruction to the N network interface cards when a preset condition is detected, where the update instruction is used to indicate The N network interface cards update the offload flow table associated with the target packet, and the preset conditions include that the slow path forwarding rule corresponding to the target packet is changed, the connection of the target packet is aged, and the virtual machine port is deleted. and one or more of Transmission Control Protocol TCP connection state changes.
  • the apparatus further includes: a third updating unit, configured to release the second network interface when detecting that the state of the second network interface card among the N network interface cards is abnormal The aggregation of logical ports corresponding to the card and logical ports corresponding to other network interface cards in the N network interface cards except the second network interface card, where the second network interface card is the N network interface cards any one of the network interface cards; send a marking instruction to the second network interface card, and release the offload flow table stored in the second network interface card and the precise flow table set that meets the unloading conditions included in the precise flow table set A one-to-one correspondence between tables, wherein the marking instruction is used to instruct the second network interface card to mark the stored offload flow table as invalid.
  • a third updating unit configured to release the second network interface when detecting that the state of the second network interface card among the N network interface cards is abnormal The aggregation of logical ports corresponding to the card and logical ports corresponding to other network interface cards in the N network interface cards except the second network interface card, where the second network interface
  • the third update unit is further configured to update the logical port corresponding to the second network interface card with the other network interface card when the second network interface card is in a normal state Corresponding logical port aggregation; unloading the precise flow table in the precise flow table set to the second network interface card, wherein the precise flow table unloaded to the second network interface card constitutes the second network interface
  • the offload flow table set corresponding to the card establish a one-to-one correspondence between the offload flow table included in the offload flow table set corresponding to the second network interface card and the precise flow table included in the precise flow table set that meets the offload condition .
  • the second receiving unit is further configured to receive, through the second port, a data stream sent by the target virtual machine, where the data stream includes the packet, and in the data stream The included messages match the same offload flow table, and the data flow is divided into K queues;
  • the sending unit is further configured to send the data flow to N virtual functions corresponding to the N network interface cards, wherein, each virtual function is responsible for receiving the data flow of K/N queues, so that the target network interface card queries whether there is an offload flow table corresponding to the message according to the data flow of K/N queues, wherein , K is an integer multiple of N, the virtual network card of the target virtual machine is configured as K queues, and the data flow is determined by the target based on the correspondence between the K queues of the virtual network card and the N virtual functions
  • the memory of the virtual machine is directly copied to the memory of the N network interface cards to realize zero-copy transmission of the data stream from the target virtual machine to the N network interface cards.
  • an embodiment of the present invention provides a physical machine, where the physical machine includes a host and N network interface cards, and the host runs M virtual machines and any of the possible implementations of the first aspect above.
  • the virtual switch provided, the N network interface cards are connected to the host through the host interface, the N network interface cards are connected to the external network through the network interface, M and N are integers greater than or equal to 2, the M virtual switches
  • the machine includes a target virtual machine, and the N network interface cards include a target network interface card, wherein:
  • the virtual switch is configured to establish a mapping relationship between N port identifiers and target port identifiers of the N logical ports corresponding to the N network interface cards, so as to aggregate the N logical ports into the first Port; wherein, the logical port corresponding to each network interface card is a logical port formed by the aggregation of the physical ports of each network interface card based on the link aggregation control protocol LACP;
  • the target network interface card is used to receive a message, the message is a message sent by a physical switch connected to the physical machine or a message sent by a target virtual machine, and the target virtual machine is the M virtual machine. Any one of the machines, the target network interface card is one of the N network interface cards;
  • the virtual switch is further configured to, when the target network interface card finds that the target network interface card does not have an offload flow table corresponding to the message, send the message through the first port.
  • the precise flow table corresponding to the text is offloaded to the N network interface cards.
  • the target network interface card is configured to send a message to the virtual switch when it is queried that there is no offload flow table corresponding to the message, where the message carries the message The message and the identifier of the virtual function for which the target network interface card receives the message.
  • the virtual switch is further configured to determine an accurate flow table corresponding to the message based on the message and the identifier of the virtual function of the target network interface card receiving the message.
  • the target network interface card is further configured to process the packet based on the offloaded accurate flow table.
  • the target network interface card when the target network interface card is further configured to query that an offload flow table corresponding to the message exists in the target network interface card, process the message based on the offload flow table.
  • the message is sent by the target virtual machine, the target virtual machine includes a virtual network card, and the working modes of the virtual network card include a soft pass-through mode and a hard pass-through mode; the target The virtual machine is further configured to send the message to the virtual switch when the working mode of the virtual network card of the target virtual machine is configured as a soft pass-through mode; the virtual switch is further configured to receive the message through the second port In the message sent by the target virtual machine, the second port is a logical port formed by aggregation of N virtual functions corresponding to the N network interface cards in the virtual switch; the virtual switch also uses determining a target virtual function from the N virtual functions corresponding to the N network interface cards; the virtual switch is further configured to send the message to the target virtual function;
  • the target virtual machine is further configured to determine the target virtual function from the N virtual functions corresponding to the N network interface cards when the working mode of the virtual network card of the target virtual machine is configured as a hard pass-through mode ; the target virtual machine is further configured to send the message to the target virtual function through a third port, wherein the third port is formed by the aggregation of the N virtual functions in the target virtual machine logical port.
  • the virtual switch is further configured to determine that the precise flow table corresponding to the packet satisfies the unloading condition, wherein when it is used to determine that the precise flow table corresponding to the packet satisfies the unloading condition, the The virtual switch is specifically configured to determine, according to the message, that the connection state between the virtual machine sending the message and the virtual switch is stable; and/or determining the flow rate of the virtual machine sending the message according to the message greater than or equal to the preset threshold.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offload flow tables included in each offload flow table set have a one-to-one correspondence with the precise flow tables included in the precise flow table set that satisfy the unloading conditions
  • the N offload flow tables in the N offload flow table sets correspond to the same precise flow table
  • the flow table is the same.
  • the virtual switch is further configured to, when detecting that the target offload flow table stored in the first network interface card of the N network interface cards is deleted, send the data to the N network interface cards.
  • the interface card sends a deletion instruction to other network interface cards except the first network interface card, where the deletion instruction is used to instruct to delete the stored offload flow table that is the same as the target offload flow table, and the first network interface card is any one of the N network interface cards, and the target offload flow table is any one of multiple offload flow tables stored in the first network interface card.
  • the virtual switch is further configured to send an update instruction to the N network interface cards when a preset condition is detected, where the update instruction is used to instruct the N network interface cards Updating the offload flow table associated with the target message, the preset conditions include the change of the slow-path forwarding rule corresponding to the target message, the aging of the connection of the target message, the deletion of the virtual machine port, and the transmission control protocol TCP connection status one or more of the changes.
  • the virtual switch is further configured to release the logical port corresponding to the second network interface card from the Aggregation of logical ports corresponding to other network interface cards in the N network interface cards except the second network interface card, where the second network interface card is any one of the N network interface cards ; Send a marking instruction to the second network interface card, and release the one-to-one correspondence between the unloading flow table stored in the second network interface card and the precise flow table that meets the unloading condition included in the set of precise flow tables relationship, wherein the marking instruction is used to instruct the second network interface card to mark the stored offload flow table as invalid.
  • the virtual switch is further configured to: when the second network interface card is in a normal state, the virtual switch associates the logical port corresponding to the second network interface card with the other network
  • the logical ports corresponding to the interface cards are aggregated; the precise flow tables in the precise flow table set are unloaded to the second network interface card, wherein the precise flow tables unloaded to the second network interface card constitute the second network interface card.
  • the set of offload flow tables corresponding to the network interface card ; establishing one of the offload flow table included in the set of offload flow tables corresponding to the second network interface card and the precise flow table included in the set of precise flow tables that satisfy the offload condition Correspondence.
  • the target virtual machine when the working mode of the virtual network card of the target virtual machine is configured as the soft pass-through mode, the target virtual machine is further configured to configure the number of queues of the virtual network card to be K and to send The data flow is divided into K queues, wherein the data flow includes the message, and the message included in the data flow matches the same offload flow table; the virtual switch is also used to pass the second port receiving the data stream sent by the target virtual machine; the virtual switch is further configured to send the data stream to N virtual functions corresponding to the N network interface cards, wherein each virtual function is responsible for K /N queues receive data flows, so that the target network interface card queries whether there is an offload flow table corresponding to the message according to the data flows of K/N queues, where K is an integer multiple of N, and the The data flow is directly copied from the memory of the target virtual machine to the memory of the N network interface cards based on the correspondence between the K queues of the virtual network card and the N virtual functions, so as to realize that the data flow is controlled by the
  • an embodiment of the present invention provides a physical machine, where the physical machine includes a processor, and the processor is configured to support the virtual switch to implement corresponding functions in the flow table processing method provided in the first aspect or the second aspect.
  • the physical machine may also include a memory, coupled to the processor, that holds program instructions and data necessary for the physical machine.
  • the physical machine may also include a communication interface for the physical machine to communicate with other devices or a communication network.
  • the present application provides a chip system
  • the chip system includes a processor for supporting a physical machine to implement the functions involved in the first aspect or the second aspect, for example, generating or processing the above flow table processing method the information involved.
  • the chip system further includes a memory for storing necessary program instructions and data.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions used in the processor in the physical machine provided in the first aspect or the second aspect, which contains instructions for executing the foregoing aspect designed program.
  • an embodiment of the present invention provides a computer program, wherein the computer program includes instructions that, when the computer program is executed by a computer, cause the computer to execute the first aspect or the second aspect. The process executed by the processor in the physical machine.
  • FIG. 1 is a schematic diagram of the principle of a virtual switch provided by an embodiment of the present invention.
  • FIG. 2 is a system architecture diagram of an OpenFlow virtual switch offloading solution provided by an embodiment of the present invention.
  • FIG. 3 is a system architecture diagram of an elastic virtual switch provided by an embodiment of the present invention.
  • FIG. 4 is a system architecture diagram of a single root input and output virtualization binding solution provided by an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a server architecture provided by an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a physical machine provided by an embodiment of the present invention.
  • FIG. 7 is a schematic flowchart of a flow table processing method provided by an embodiment of the present invention.
  • FIG. 8 is a schematic flowchart of a flow table processing method provided by an embodiment of the present invention.
  • FIG. 9 is a schematic flowchart of a flow table processing method provided by an embodiment of the present invention.
  • FIG. 10 is a schematic flowchart of a flow table processing method provided by an embodiment of the present invention.
  • FIG. 11 is a schematic flowchart of a flow table processing method provided by an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of an apparatus for processing a flow table according to an embodiment of the present invention.
  • FIG. 13 is a schematic structural diagram of another physical machine provided by an embodiment of the present invention.
  • a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device may be components.
  • One or more components may reside within a process and/or thread of execution, and a component may be localized on one computer and/or distributed between 2 or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more data packets (eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals) Communicate through local and/or remote processes.
  • data packets eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals
  • FIG. 1 is a schematic diagram of the principle of a virtual switch.
  • a virtual switch consists of a management and control plane and a forwarding plane.
  • the forwarding plane includes virtual input/output (I/O), switching plane and physical I/O three parts.
  • the virtual switch is configured and managed by Neutron or an Agile Controller (Agile Controller, AC), and delivers the creation and configuration of objects such as virtual network cards and physical network interface cards.
  • the virtual machine or container cooperates with the virtual IO backend of the virtual switch through the front-end virtual NIC driver to complete the sending and receiving of packets.
  • kernel mode softswitch In the kernel-mode softswitch and user-mode softswitch stages, the data flow enters the virtual switch through the network interface card.
  • the virtual switch analyzes the packet of the data flow and determines How to process the packet, and finally record the processing process of the packet and generate a relevant accurate flow table.
  • the virtual switch When the subsequent packets of the data flow flow flow into the virtual switch, the virtual switch will hit the corresponding precise flow table according to the information of the packet, and then directly execute the behavior indicated in the precise flow table to complete the processing of the packets.
  • the packet After the packet is encapsulated or decapsulated, it is forwarded to other devices through the network interface card.
  • the matching of the flow table and the execution of the actions in the flow table directly affect the packet processing performance of the virtual switch.
  • the virtual switch In order to improve the packet processing efficiency, in the hardware offload switching stage, the virtual switch offloads the precise flow table to the network interface card.
  • the network interface card When the packet passes through the network interface card, the network interface card directly hits the corresponding offload flow table according to the information of the packet, and then processes the packet according to the hit offload flow table entry, and no longer forwards the packet to the virtual switch.
  • the packet processing efficiency can be improved.
  • Hardware offload switching technology is gradually used by mainstream manufacturers. This method has many advantages, such as high performance and rich functions.
  • the hardware offload switching technology has reliability problems across network interface cards due to the complex software-hardware coordination mechanism. It can only achieve the reliability of different links in a single network interface card. If the single network interface card fails, the entire system will fail. , so there is a risk of a single point of failure.
  • FIG. 2 is a system architecture diagram of an Openflow Virtual Switch (OVS) offloading scheme.
  • the system architecture includes a host and a Smart Network Interface Card (Smart NIC).
  • Virtual machines and OVS run in the host.
  • OVS includes user space and kernel space.
  • the user space includes the OVS control plane, and the OVS control plane further includes the Ovsdb-sever process and the Ovsdb-vswitch process.
  • the kernel space includes the OVS kernel Datapath (DP) forwarding library.
  • the hardware module of the Smart NIC also includes an embedded virtual switch (Embedded Virtual Switch, eVS), and the embedded virtual switch includes a virtual switch offload (vSwitch offload) module inside.
  • eVS embedded Virtual Switch
  • vSwitch offload virtual switch offload
  • the OVS control plane is responsible for database management, slow path rule learning, openflow slow path flow table rule matching, and generation and management of accurate flow tables.
  • the OVS control plane is required to assist in processing.
  • OVS Kernel DP is responsible for completing the search and forwarding of accurate flow tables in the kernel space. When hardware offloading is enabled, it cooperates with the OVS control plane to complete the generation and unloading of accurate flow tables through the TC flower tool provided by the Linux kernel.
  • the vSwitch offload module runs inside the network interface card and provides fast-path forwarding for virtual machines. Specifically, when OVS is initialized, it will issue a default rule to the embedded switch. For a data flow, when the first packet reaches the embedded switch, if the packet does not match any other rules, it will be matched by the default rules. The behavior corresponding to this default rule is to send the message to the management host of the embedded switch, that is, the OVS kernel path forwarding library located in the kernel space.
  • the OVS kernel path forwarding library will query the ovs-vswitchd process in user space. Because the ovs-vswitchd process stores OpenFlow rules, ovs-vswitchd can complete the behavior matching operation according to the OpenFlow rules, that is, match the rules corresponding to the packets from a bunch of OpenFlow rules, and implement forwarding according to the behavior in these rules. At the same time, the ovs-vswitchd process will determine whether the rules corresponding to the current data flow can be offloaded to the network interface card.
  • the ovs-vswitchd process calls to offload OpenFlow rules to hardware via the TC interface, if available. In this way, subsequent packets of the same data flow can be forwarded directly in the embedded virtual switch of the network interface card, without going to the host operating system.
  • OpenFlow virtual switch offloading solution shown in Figure 2 can effectively realize the function of hardware offloading and forwarding, it solves the problem of network performance (throughput, delay, packet Forwarding performance (Packet Per Second, PPS)).
  • PPS Packet Per Second
  • only one offload network interface card can be used, which can only provide link-level reliability, and cannot provide reliability guarantee for multiple network interface cards. If the network interface card fails, then the entire system fails, and there is a risk of a single point of failure.
  • FIG. 3 is a system architecture diagram of an elastic virtual switch (Elastic Virtual Switch, eVS).
  • eVS is a virtual switch based on the extension and transformation of open source OVS.
  • the system architecture includes host and Smart NIC. Virtual machines and elastic virtual switches run on the host.
  • the eVS includes the eVS control plane, the core forwarding module, and the Vhostdp soft passthrough module.
  • the core forwarding module includes the software slow-path forwarding module and the intelligent offload engine module.
  • Smart NICs include datapath modules.
  • the eVS control plane is responsible for database management and flow table rule matching of the openflow slow path, as well as generation and management of accurate flow tables, and also provides functions such as security rule checking.
  • the software slow-path forwarding module integrates the forwarding engine and cooperates with the hardware offload engine module, and is responsible for combining and normalizing the results of multiple table lookups and execution actions on the forwarding path to form a hardware offload flow table for single matching and single execution, so that Easier to do inside the hardware smart offload network interface card.
  • the Vhostdp soft pass-through module is responsible for transferring IO packets between the network interface card and the virtual network card.
  • the data path module in the intelligent network interface card runs inside the hardware network interface card, and uses the offload flow table delivered by the elastic virtual switch to provide fast path forwarding for virtual machines.
  • the elastic virtual switch shown in Figure 3 can effectively implement the function of hardware offloading and forwarding and solve performance problems, there is still a problem that only one hardware offloading network interface card can be used, and the Bond technology can only provide link-level reliability and cannot provide Reliability assurance of multiple network interface cards.
  • Figure 4 is a system architecture diagram of a single root input/output virtualization (SR-I/OV) binding bond scheme.
  • the system is based on SR-I/OV virtualization and introduces the linux bond component, and controls the working mode of the bond of the virtual function in the virtual machine through the LACP bond of the PF.
  • SR-I/OV single root input/output virtualization
  • Both network interface cards have the SR-I/OV function enabled.
  • Each of the two network interface cards contributes one virtual function to the two virtual machines.
  • the physical function PF of the two network interface cards is Bond in the LACP mode of the host group, and the LACP aggregation negotiation function is enabled on the TOR side.
  • the two virtual function group load balancing mode (non-LACP) Bonds contributed by the two network interface cards in the virtual machine a virtual function is selected to send and receive traffic according to the configured hash algorithm.
  • the LACP bond aggregation state of the host changes, the function and bond in the virtual machine are notified through the link control mechanism of the hardware network interface card, and the link switch is triggered.
  • the SR-I/OV bond solution shown in Figure 4 can solve the reliability problem across network interface cards and improve performance.
  • network interface card forwarding in SR-I/OV mode can only provide simple Layer 2 mac+ VLAN forwarding, because there is no virtual switch to perform software slow path rule learning on packets, and does not support hardware offloading of virtual switches, it cannot support the rich service function requirements of cloud computing platforms.
  • FIG. 5 is a schematic diagram of a server architecture provided by an embodiment of the present invention.
  • the server architecture includes at least one physical machine (or referred to as a computer device, a physical host, or a physical computer) 10 and a physical switch 20 .
  • a plurality of physical machines 10 are connected through a physical switch 20 and then connected to an external network to implement communication with the outside.
  • each physical machine 10 has a complete software environment and hardware environment
  • the hardware environment of the physical machine at least includes a host and a network interface card (or network card, physical network card or physical network interface card) (network interface card, NIC) 105 .
  • the part of the physical machine other than the network interface card is called the host.
  • the host includes a CPU 103 and a memory 104 .
  • the software environment of the physical machine at least includes a virtual switch 102 and at least one virtual machine 101 , that is, the virtual switch 102 and at least one virtual machine 101 run on the host of the physical machine 10 .
  • the software environment of the physical machine further includes a virtual machine monitor (VMM) (not shown in the figure), and the virtual machine monitor is also called a virtual machine manager (virtual machine manager) or a hypervisor (hypervisor). , which is used to manage the above-mentioned one or more virtual machines 101 .
  • VMM virtual machine monitor
  • hypervisor hypervisor
  • one or more virtual machines can be simulated on a physical machine.
  • a virtual machine can work like a physical machine.
  • a user can install an operating system and applications on a virtual machine; in another example, a user can access network resources through the virtual machine.
  • a virtual machine can be seen as an application running on a physical machine, but for an application running in a virtual machine, the virtual machine provides a working environment for the application just like a real physical machine.
  • the virtual machine includes user mode and kernel mode, which are two operating levels of the operating system.
  • the user issues various instructions in the user mode, and the instructions issued by the user are generated from the user mode of the virtual machine and distributed to the kernel mode of the virtual machine.
  • one or more virtual machines simulated by a physical machine need to share the network interface card to communicate with external resources.
  • communication between virtual machines is also required.
  • the virtual switch can realize the mutual communication between different virtual machines in the same host. communication.
  • the network interface card in the embodiment of the present application is a network interface card supporting a single root input/output virtualization (Single Root input/Output Virtualization, SR-I/OV) function.
  • SR-I/OV technology allows efficient sharing of peripheral component interconnect express (PCIe) devices (such as network interface cards) among multiple virtual machines.
  • PCIe peripheral component interconnect express
  • SR-I/OV introduces the concepts of physical function (PF) and virtual function (VF) to support the virtualization of network interface cards.
  • PF is a peripheral component interconnect (PCI) function supported by the network interface card, and PF can extend several virtual functions.
  • a virtual function is a "network card" or an instance virtualized by a network interface card that supports SR-I/OV. The virtual function will be presented in the form of an independent network interface card.
  • Each virtual function has its own exclusive PCI configuration area.
  • Each virtual function in the network interface card is configured with bandwidth resources for data transmission. It will be allocated to the virtual machine running on the host device via the hypervisor.
  • the virtual switch function is also provided inside the network interface card, and the bandwidth limitation function can be provided through the physical function/virtual function. The user (or administrator) can allocate bandwidth to each virtual function according to this bandwidth limit function.
  • a virtual function corresponds to a virtual network interface card (virtual network interface card, vNIC, referred to as a virtual network card) of a virtual machine. After the network interface card enables SR-I/OV, the network interface card will interact with the virtual function driver VF driver of the virtual machine through the virtual function.
  • vNIC virtual network interface card
  • SR-I/OV technology Through SR-I/OV technology, a single network interface card is virtualized into multiple virtual function interfaces, each virtual function interface has a separate virtual PCIe channel, and these virtual PCIe channels share the PCIe channel of the network interface card.
  • Each virtual machine can occupy one or more virtual function interfaces, so that the virtual machine can directly access its own virtual function interface without the coordinated intervention of the virtual machine monitor, thereby greatly improving the network throughput performance.
  • the technology of directly connecting the network interface card of SR-I/OV to the virtual machine is exemplarily adopted. In actual use, other technologies that support the direct connection between the network interface card and the virtual machine may also be adopted.
  • the network interface card in the embodiment of the present application is not limited to the commercial network interface card chip, that is, the network interface card in the embodiment of the present application may include NP (Network Processor, network processor), FPGA (Field-Programmable Gate Array, field-programmable gate array) Programmable devices such as gate array) and commercial network interface card chips. Specifically, all chips or devices capable of realizing the function of the network interface card can be used as the network interface card in the embodiments of the present application, and all fall within the protection scope of the present application.
  • the virtual machine 101 is connected to the network interface card 105 or the virtual machine 101 is connected to the network interface card 105 through a virtual switch, and then communicates with the outside world.
  • the virtual machine 101 when the virtual network card of the virtual machine 101 is configured in the hard pass-through mode, the virtual machine 101 is directly connected to the network interface card 105; when the virtual network card of the virtual machine 101 is configured in the soft pass-through mode, the virtual machine 101 communicates with the network interface card 105 through the virtual switch.
  • a network interface card 105 is connected.
  • any physical machine 10 in the embodiment of the present application can be used as the physical machine in the present application to implement the flow table processing method provided by the embodiment of the present application.
  • all virtual machines can be connected to the network interface card and the virtual switch.
  • only some virtual machines (the working mode of the virtual network card is configured as hard pass-through) may be connected to the network interface card, and other virtual machines may be connected to the network interface card. (The working mode of the virtual network card is configured as soft pass-through.) It is connected to the virtual switch.
  • the configuration method of the specific virtual machine can be configured according to the scene as needed, and it is not limited to be all connected to the network interface card.
  • the server architecture in FIG. 5 is only an exemplary implementation in the embodiment of the present invention, and the server architecture in the embodiment of the present invention is not limited to the above server architecture.
  • FIG. 6 is a schematic structural diagram of a physical machine provided by an embodiment of the present invention.
  • the hardware environment of the physical machine includes a host, a first network interface card 105-A and a second network interface card 105-B.
  • a first virtual machine 101-1, a second virtual machine 101-2 and a virtual switch 102 run in the host.
  • the first network interface card 105-A and the second network interface card 105-B in the embodiment of the present invention are substantially the same, and both may be the network interface card 105 provided in the embodiment corresponding to FIG. 5 .
  • the two network interface cards included in the physical machine are respectively named as a first network interface card and a second network interface card.
  • both the first virtual machine 101-1 and the second virtual machine 101-2 in this embodiment of the present invention may be the virtual machine 101 provided in the embodiment corresponding to FIG. 5 .
  • the virtual machine includes The virtual machine whose working mode is configured as the hard pass-through mode in the virtual network card is called the first virtual machine 101-1, and the virtual machine whose working mode is configured as the soft pass-through mode in the virtual network card included in the virtual machine is called the second virtual machine 101-2.
  • the first virtual machine 101-1 whose working mode of the virtual network card is configured as a hard pass-through mode includes a virtual machine binding (VM Bond) module 1001 and a device object.
  • VM Bond virtual machine binding
  • the virtual machine generates different device objects, and these different device objects are uniformly managed by the virtual function driver of the virtual machine.
  • the virtual function driver is used to implement data transmission between the virtual machine and different virtual functions corresponding to different network interface cards through the virtual function driver in a hard pass-through scenario. Among them, the virtual function driver is loaded only once.
  • the second virtual machine 101-2 whose working mode of the virtual network card is configured as a soft pass-through mode includes a paravirtualized driver Vitio-net, and the second virtual machine communicates with the virtual switch through the paravirtualized driver.
  • the VM Bond module 1001 is essentially a virtual IO interface, and is used for, when the virtual network card of the first virtual machine 101-1 is configured in the virtual function hard pass-through mode, to assign each of the two network interface cards in the virtual machine to A virtual function of the virtual machine is bound to form a network interface, so that when the virtual machine sends a message, one of the virtual functions is selected based on the hash algorithm through the VM Bond module 1001, and then the message is sent to the extension out of the virtual machine through the virtual function.
  • Virtual function network interface card 105 Specifically, in the hard pass-through scenario, viewed from the virtual switch side, the virtual machine side only provides one logical port, that is, the VM Bond module 1001.
  • the tuple determines a hash value and is used for the first A network interface card 105-A and a second network interface card 105-B perform hash load sharing, and then determine that the first network interface card (and or the second network interface card) and the first network interface card are allocated to the first virtual machine
  • the virtual function vfA.1 of 101-1 (and or the virtual function vfB.1 of the second network interface card assigned to the first virtual machine 101-1).
  • the virtual switch 102 includes: a core forwarding module 1021, a virtual switch bonding (vSW-Bond) module 1022 and a Vhostdp soft pass-through module 1023, wherein the core forwarding module 1021 further includes a software slow path forwarding module 1024 and a multi-network interface card intelligent offload engine Module 1025.
  • vSW-Bond virtual switch bonding
  • Vhostdp soft pass-through module 1023 wherein the core forwarding module 1021 further includes a software slow path forwarding module 1024 and a multi-network interface card intelligent offload engine Module 1025.
  • the software slow path forwarding module 1024 is responsible for flow rule management and packet slow path matching of the virtual switch 102, and provides service functions such as tunnel management and security rule management.
  • the multi-network interface card intelligent offload engine module 1025 is responsible for collecting multiple accurate flow tables for packet matching in slow-path forwarding and the corresponding packet editing results, and combining these information for normalized processing, combining the corresponding flow rate and status of the packets. Policy management. Finally, an offload flow table is generated, and the offload flow table is delivered to the first hardware data path (Datapath) module 1051-A and the second hardware respectively corresponding to the first network interface card 105-A and the second network interface card 105-B. Datapath module 1051-B.
  • Datapath data path
  • the vSW-Bond module 1022 is essentially a virtual IO interface, which is used for, after the multiple links of each network interface card are aggregated into a bond, the vSW-Bond module 1022 combines the two network interface cards.
  • the two bonds ie, Hwbond-A and Hwbond-B
  • Hwbond-A and Hwbond-B are aggregated to form the Uplink port of the virtual switch.
  • the vSW-Bond module 1022 monitors the status change of Hwbond-A and/or Hwbond-B, it will synchronously notify the VF bond module 1026 in the Vhostdp soft pass-through module 1023 and the VM Bond module 1001 in the first virtual machine 101-1 .
  • the Vhostdp soft pass-through module 1023 further includes a VF bond module 1026.
  • the virtual switch When the virtual network card of the second virtual machine 101 is configured as paravirtualized Virtio (ie, soft pass-through mode), the virtual switch simultaneously allocates a virtual function corresponding to the virtual network card from the two network interface cards.
  • the VF bond module 1026 is essentially a virtual IO interface, and is used for, when the virtual network card of the second virtual machine 101 is configured in the soft pass-through mode, to assign each of the two network interface cards to the virtual A virtual function binding of the machine, the back end of the Virtio virtual network card and the binding of these two virtual functions form a peer-to-peer relationship.
  • Packet transport is completed through the Vhostdp soft pass-through module 1023 .
  • the physical machine also utilizes a multi-queue mechanism, and when the virtual network card of the virtual machine is configured with a number of queues of K (K is an even number), the number of queues corresponding to the first network interface card and the second network interface card Each virtual function is responsible for sending and receiving traffic in K/2 queues, and a one-to-one correspondence is established between the queues of the virtual network card and the virtual function queues. In this way, the soft pass-through module 1023 sends and receives packets in a zero-copy manner.
  • the network interface card includes a hardware datapath Datapath module, Bond and at least one virtual function.
  • the first network interface card 105-A includes a first hardware data path Datapath module 1051-A, HwBond-A, virtual function vfA.1 and virtual function vfA.2, and a second network interface card 105-B includes a second hardware datapath Datapath module 1051-B, HwBond-B, virtual function vfB.1 and virtual function vfB.2.
  • the first hardware data path Datapath module 1051-A or the second hardware data path Datapath module 1051-B is specifically configured to receive the offload flow table issued from the multi-network interface card intelligent offload engine module 1025. For example, when a packet sent by the first virtual machine 101-1 or the first virtual machine 101-2 reaches at least one of the first network interface card 105-A and the second network interface card 105-B, the first network interface card 105-A (or the second network interface card 105-B) queries the offload flow table matching the message through its internal first hardware Datapath module 1051-A (or the second hardware Datapath module 1051-B), if there is The unloading flow table matched by the message is forwarded according to the unloading flow table; if there is no unloading flow table matching the message, it is sent to the core slow-path forwarding module 1024 and the multiplexer by calling the upcall thread upstream.
  • the network interface card intelligent offload engine module 1025 performs matching and learning to generate a precise flow table corresponding to the message, and the multi-network interface card intelligent offload engine module 1025 finally unloads the generated precise flow table to the first hardware Datapath module 1051-A and The second hardware Datapath module 1051-B.
  • Bond (Hwbond-A or Hwbond-B as shown in Figure 6) is a logical port formed by the aggregation of physical ports inside each network interface card based on the link aggregation control protocol LACP.
  • a virtual function is a "network card" or a virtual instance created by a network interface card that supports SR-I/OV. After the network interface card enables SR-I/OV, the network interface card will communicate with the virtual machine through the virtual function VF. VF driver for data interaction.
  • the structure of the physical machine in FIG. 6 is only an exemplary implementation in the embodiment of the present invention, and the structure of the physical machine in the embodiment of the present invention includes but is not limited to the above structure.
  • each module shown in FIG. 6 may be a software module or program running in a physical machine, and the module or program implements corresponding functions when executed by the processor. It can be understood that each module provided in the embodiments of the present application may also be implemented in the form of hardware, for example, implemented as a processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application-Specific Integrated Circuit, ASIC) ), Field Programmable Gate Array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof, which is not limited in this application.
  • DSP Digital Signal Processor
  • ASIC Application-Specific Integrated Circuit
  • FPGA Field Programmable Gate Array
  • the VM Bond module 1001 the VF bond module 1026 and the vSW-Bond module 1022.
  • the slow path forwarding of packets is completed based on the VM Bond module 1001 and the vSW-Bond module 1022
  • the fast path forwarding of packets is completed based on the VM Bond module 1001.
  • the virtual network card of the virtual machine is configured in the soft pass-through mode
  • the slow path forwarding of packets is completed based on the VF bond module 1026 and the vSW-Bond module 1022
  • the fast path forwarding of packets is completed based on the VF bond module 1026.
  • the above three virtual IO interfaces can be used to remove hardware specification restrictions and be used according to scenarios.
  • the physical machine provided by the embodiment of the present application supports fault detection and self-healing on the one hand, and automatically switches to soft pass-through to continue providing services when a virtual network card hard pass-through failure is detected. On the other hand, it supports simultaneous unloading of multiple network interface cards. In the network interface card and standby network interface card mode, when the main network interface card fails, the virtual switch automatically switches to the standby network interface card, and automatically completes the offload data synchronization.
  • FIG. 7 is a schematic flowchart of a flow table processing method provided by an embodiment of the present invention.
  • the method can be applied to any physical machine 10 in the server architecture described in FIG. 5, and the method can be applied to In the physical machine 10 described above in FIG. 6 , the physical machine 10 can be used to support and execute steps S701 and S702 of the method flow shown in FIG. 7 .
  • the physical machine includes a host and N network interface cards, a virtual switch and M virtual machines run on the host, the N network interface cards are connected to the host through a host interface, and the N network interface cards are connected through a network The interface is connected to the external network, and M and N are integers greater than or equal to 2.
  • M and N are integers greater than or equal to 2.
  • the method may include the following steps S701 to S703, optionally, may further include steps S704 to 707, optionally, may further include step S708.
  • Step S702 may optionally include S702a-S702c, and may also include S702d-S702e.
  • the virtual switch establishes a mapping relationship between the N port identifiers of the N logical ports and the target port identifiers, so as to aggregate the N logical ports into the first port; wherein, each network interface The logical port corresponding to the card is a logical port formed by the aggregation of the physical ports of each network interface card based on the link aggregation control protocol LACP.
  • the first port is a logical port formed by aggregation of N logical ports corresponding to the N network interface cards, and the N logical ports are set as corresponding target port identifiers.
  • the physical ports inside each network interface card are aggregated based on the logical ports formed by the link aggregation control protocol LACP to form the first-level binding;
  • the virtual switch establishes N ports of the N logical ports
  • the mapping relationship between the identifier and the target port identifier is set, so that the N logical ports corresponding to the N network interface cards are set as the corresponding target port identifiers, so as to form a second-level load balancing binding.
  • the above two-level binding realizes the unloading of multiple network interface cards of the accurate flow table.
  • the virtual switch can automatically switch to other available network interface cards, so as to achieve reliable cross-network interface cards.
  • the N logical ports are set as corresponding target port identifiers to implement aggregation of N logical ports corresponding to the N network interface cards.
  • the reason why the N logical ports described here are set as corresponding target port identifiers is: if different network interface cards correspond to different logical port identifiers, different logical port identifiers mean that multiple network interface cards correspond to multiple different logical port identifiers.
  • a data loop may be formed between the physical switch and the virtual switch based on multiple different logical links corresponding to multiple network interface cards.
  • the first network interface card among the multiple network interface cards receives an Address Resolution Protocol (ARP) packet, and the packet may be sent by the virtual machine to the first network interface card or may be If other physical machines are sent to the first network interface card through the physical switch, since the precise flow table corresponding to such packets cannot be offloaded to the network interface card, the packets must be broadcast based on the virtual switch. Therefore, the first network interface card will The ARP packet is sent to the virtual switch, so that the virtual switch broadcasts the ARP packet.
  • ARP Address Resolution Protocol
  • the first network interface card sends the ARP packet to the virtual machine via the logical link corresponding to the first network interface card.
  • the virtual switch will re-broadcast the ARP packet to the physical network through the logical link corresponding to the second network card. Switch, so far the ARP packet has generated a data loop between the virtual switch and the physical switch.
  • the virtual switch will The packet is broadcast to the physical switch through the logical link corresponding to the second network card. After receiving the ARP packet, the physical switch will broadcast the ARP packet to the virtual switch again through the logical link corresponding to the first network card. There is also a data loopback between the virtual switch and the physical switch. Data loopback between physical switches and virtual switches affects system performance and even causes abnormal packet processing.
  • Step S702 the target virtual machine sends a message to the target network interface card.
  • the packets received by the target network interface may be sent by the target virtual machine, or may be sent by other physical machines via the physical switch.
  • the embodiments of the present application are described by taking the target virtual machine sending a message to the target network interface card as an example.
  • the target virtual machine is any one of the M virtual machines, and the target network interface card is one of the N network interface cards.
  • the target virtual machine includes a virtual network card, and the working modes of the virtual network card include a soft pass-through mode and a hard pass-through mode.
  • the target virtual machine sends the packet to the soft pass-through module of the virtual switch, and the soft pass-through module selects a virtual function based on the hash algorithm through the internal VF bond module. , and then determine the target network interface card that extends the virtual function, and send the message to the target network interface card.
  • the target virtual machine selects a virtual function through the internal VM bond module based on the hash algorithm, and then determines the target network interface that extends the virtual function. card, and send the message to the target network interface card through the VM bond module.
  • the VF bond module N virtual functions corresponding to N network interface cards are aggregated
  • the VM bond module N virtual functions corresponding to N network interface cards are aggregated.
  • the offload flow tables stored in the N network interface cards included in the physical machine are exactly the same, no matter which network interface card virtual machine is selected by the soft pass-through module through the internal VF bond module or the target virtual machine through the internal VM bond module
  • This virtual function can implement packet forwarding.
  • the physical switch can also select a network interface card based on the hash algorithm in the direction sent by the physical switch to the host and the virtual machine, and then the selected network interface card realizes data forwarding.
  • Step S703 when the target network interface card finds that the target network interface card does not have an unloading flow table corresponding to the message, the virtual switch unloads the precise flow table through the first port to the N network interface cards.
  • the first port formed by the above-mentioned two-level binding can avoid data loopback between the physical switch and the virtual switch which may be caused by N logical ports corresponding to different port identifiers, thereby affecting the system performance.
  • the performance even leads to the problem of abnormal packet processing;
  • the multi-network interface card offloading of the accurate flow table is realized, that is, the virtual switch can offload the accurate flow table to all the network interface cards through the first port, This solves the problem of service termination due to the failure of the single network interface card during the process of offloading the precise flow table to a single network interface card or processing packets based on a single network interface card. All network interface cards connected to the host, so that when any network interface card fails, the virtual switch can switch to other network interface cards, thereby ensuring the reliability of the packet processing service.
  • the virtual switch unloads the precise flow table to the N network interface cards through the first port when it is determined that the precise flow table corresponding to the packet satisfies the unloading condition
  • the method may further include steps S704 to S707 in the following steps.
  • Step S704 the target network interface card queries whether there is an offload flow table corresponding to the message.
  • the message is composed of matching information and payload.
  • the matching information is used for matching with the matching field of the flow table.
  • a flow table is a table that describes what kind of data flow packets should be processed, and is used to control data flow in a software defined network (SDN). It can also be called an SDN flow table. Specifically, a flow table conforming to the OpenFlow protocol or a flow table conforming to other protocols may be used.
  • the flow table is divided into an offload flow table (also called a hardware flow table) and a precise flow table (also called a software flow table) according to different storage locations.
  • the flow table stored in the network interface card is the offload flow table.
  • the flow table generated by the virtual switch through slow-path forwarding learning based on the packet and the virtual function identifier is an accurate flow table (stored in the virtual switch).
  • the offload flow table stored in the network interface card is kept synchronized with the precise flow table located in the virtual switch.
  • the flow table includes at least a matching field and an execution field.
  • the matching field is used to match with the packet, and the execution field is used to indicate the action to be performed by the packet matching the flow table.
  • the execution field includes the action identifier of the packet, such as forwarding, discarding, and sending to the SDN controller.
  • the matching information of the packet is used to indicate the characteristic information of the data stream to which the packet belongs.
  • the matching information may specifically be certain fields carried in the header of the packet, and these fields are all packets belonging to the same data stream. Both packets are carried, that is, packets belonging to the same data flow have the same matching information.
  • the matching information of the packet may be source IP address (SIP), source port number (SPORT), destination IP address (DIP), destination port number (DPORT), transport layer protocol number (IP type), and subtype A network identifier, through which a data stream (also referred to as a "connection") can be uniquely determined.
  • IP type transport layer protocol number
  • IP type transport layer protocol number
  • subtype A network identifier through which a data stream (also referred to as a "connection" can be uniquely determined.
  • the data flow indicates a series of packets carrying the same matching information.
  • the matching information of the packets in the same data flow can all match the matching field of the exact flow table or the offload flow table corresponding to the data flow.
  • the query of the target network interface card for whether there is an offload flow table corresponding to the message within the target network interface card may specifically be that the target network interface card queries whether there is a matching field matching the matching information of the message based on the matching information of the message. Further, the corresponding offload flow table is determined based on the matching field.
  • Step S705 the target network interface card sends a message to the virtual switch when the target network interface card finds that there is no offload flow table corresponding to the message.
  • the message carries the message and the identifier of the virtual function of the target network interface card receiving the message.
  • the target network interface card finds that the offload flow table corresponding to the message does not exist in the target network interface card, it cannot process the message. Therefore, it is necessary to compare the message with the virtual function of the target network interface card.
  • the identifier is uploaded to the virtual switch through the upcall thread, so that the virtual switch determines an accurate flow table corresponding to the message based on the message and the identifier of the virtual function of the target network interface card.
  • the identifier of the virtual function of the target network interface card is not only used to indicate which network interface card the message is sent from, but also because the virtual function of the network interface card corresponds to the virtual machine, therefore, the target network interface
  • the ID of the virtual function of the card can also be used to indicate which virtual machine sends the message.
  • the target network interface card can directly forward the message to other virtual machines or forward the message to an external network through the network interface card.
  • Step S706 the virtual switch determines an accurate flow table corresponding to the message based on the message and the identifier of the virtual function of the target network interface card receiving the message.
  • the virtual switch receives the message through the proxy port of the virtual network card.
  • the virtual switch uses the core slow path forwarding module to match the packet slow path based on the packet and the identifier of the virtual function of the target network interface card to receive the packet, and performs security check, status update and cemetery location search and other logic to finally determine the precise flow table corresponding to the message.
  • the virtual switch analyzes the information carried in the packet through the software slow-path forwarding module based on the identification of the virtual function of the packet and the target network interface card, and decides how to process the packet. After the packet processing is completed, the software slow-path forwarding module sends The process of processing is recorded and an accurate flow table corresponding to the packet is generated.
  • the above-mentioned software slow-path forwarding module analyzes, processes and generates the precise flow table corresponding to the packet.
  • the process of the packet can also be called “slow-path forwarding" of the packet .
  • the process of packet processing through the virtual switch can be called “slow path forwarding".
  • fast-path forwarding refers to a process in which packets are processed directly on a network interface card based on offload flow table matching without going through a virtual switch.
  • the virtual switch determines the precise flow table corresponding to the message based on the message and the identifier of the virtual function of the target network interface card to receive the message, which may be specifically according to the above description of the message.
  • the matching information and the identifier of the virtual function determine the exact flow table corresponding to the message.
  • Step S707 the virtual switch determines whether the precise flow table corresponding to the packet satisfies the unloading condition.
  • the virtual machine switch determines whether the precise flow table corresponding to the packet can be unloaded through the multi-network interface card intelligent offload engine module. To the network interface card, that is, it is judged whether the precise flow table corresponding to the packet satisfies the unloading condition.
  • the virtual switch determining that the precise flow table corresponding to the packet satisfies the unloading condition includes: determining, by the virtual switch, according to the packet, that the virtual machine sending the packet is the same as the virtual machine that sends the packet.
  • the connection state of the virtual switch is stable; and/or the virtual switch determines, according to the message, that the flow rate of the virtual machine sending the message is greater than or equal to a preset threshold. Due to the limited storage space of the network interface card, it is difficult to store a large number of hardware flow tables.
  • the virtual switch determines that the precise flow table corresponding to the packet satisfies the unloading condition, the virtual switch unloads the precise flow table to the N network interface cards through the first port.
  • the target virtual machine sends a message to the target network interface card, and the target network interface card sends a message to the virtual switch when it finds that there is no offload flow table corresponding to the message inside , the virtual switch determines the precise flow table corresponding to the message according to the message, and when it is determined that the precise flow table satisfies the unloading condition, the first port formed by the aggregation of all network interface cards connected to the host transfers the precise flow table to the The flow table is unloaded to all the network interface cards, so that one party can complete the processing of the message in the network interface card, without the need for the host to process, reduce the burden on the host, effectively utilize hardware resources such as network interface cards, and improve the system.
  • the switch offloads the accurate flow table to all network interface cards connected to the host, so that when any network interface card fails, the virtual switch can switch to other network interface cards, thus ensuring the reliability of packet processing services, and avoiding N
  • Each logical port corresponds to different port IDs, which may cause data loopback between the physical switch and the virtual switch, which affects the performance of the system and even causes abnormal packet processing.
  • the working modes of the virtual network card of the target virtual machine may include a soft pass-through mode and a hard pass-through mode.
  • the virtual network card of the virtual machine When the virtual network card of the virtual machine is configured in hard pass-through mode, the virtual machine is directly connected with the network interface card; when the virtual network card of the virtual machine is configured in soft pass-through mode, the virtual machine is connected with the network interface card through a virtual switch.
  • step S702 the target virtual machine sends a message to the target network interface card includes the following step S702a to S702c.
  • the target virtual machine sends the message to the virtual switch;
  • the virtual switch receives the message sent by the target virtual machine through a second port, where the second port is the N networks A logical port formed by aggregation of N virtual functions corresponding to the interface cards in the virtual switch;
  • S702b the virtual switch determines a target virtual function from the N virtual functions corresponding to the N network interface cards;
  • S702c the the virtual switch sends the message to the target virtual function;
  • step S702 the target virtual machine sends the message to the target network interface card, including the following: Steps S702d to S702e:
  • the target virtual machine determines the target virtual function from N virtual functions corresponding to the N network interface cards; S702e, the target virtual machine sends the report to the target virtual function through a third port
  • the third port is a logical port formed by aggregation of the N virtual functions in the target virtual machine.
  • the virtual network card of the virtual machine can be configured in a hard pass-through mode and a soft pass-through mode, and when a failure in the hard pass-through mode (or soft pass-through mode) is detected, it can be automatically switched. It can continue to provide services in soft pass-through mode (or hard pass-through mode), thereby lifting the hardware specification restrictions and using it according to scenarios.
  • each network interface card determines a virtual function corresponding to the virtual network card of the virtual machine, and the virtual machine aggregates the N virtual functions corresponding to the N network interface cards to form a logic Port, that is, the third port VM bond module.
  • the virtual switch determines a virtual function from each of the N network interface cards to correspond to the virtual network card of the virtual machine.
  • the N virtual functions corresponding to the card are aggregated to form a logical port, that is, the second port VF bond module.
  • the back end of the virtual network card forms a peer-to-peer relationship with the second port. Therefore, when the virtual network card of the virtual machine is configured as soft pass-through, packet transmission is completed through the soft pass-through process, wherein the packet transmission completed based on the soft pass-through process adopts a zero-copy mechanism.
  • step S708 may be further included: the target network interface card processes the packet based on the offloaded precise flow table.
  • the network interface card After the virtual switch unloads the precise flow table to the N network interface cards through the first port, when a subsequent packet of the same data flow as the packet enters the network interface card, the network interface card It will directly hit the offload flow table corresponding to the message from the stored offload flow table according to the message, and then directly execute the behavior (or operation) indicated in the offload flow table, such as outputting to the specified port, tagging or stripping VLAN tags, tagging Or strip the VxLAN header, modify the packet header, jump to other flow tables, discard, and perform CT behavior, etc., to complete the processing of the packet without reporting it to the virtual switch. processing efficiency.
  • the virtual machine may include multiple precise flow tables corresponding to the message, and the network interface card executes multiple precise flow tables based on the offloading associated with the message after receiving the subsequent message of the same data flow. domain for processing.
  • step S708 may also be performed, the target network interface card The card processes the packet based on the offload flow table.
  • packet forwarding can be divided into slow path forwarding and fast path forwarding.
  • the target network interface card After receiving the packet sent by the virtual machine, the target network interface card queries whether there is an internal offload flow table corresponding to the packet.
  • fast-path forwarding of the message is performed, that is, the target network interface card directly processes the message based on the internally stored offload flow table.
  • the target network interface card finds that there is no internal offload flow table corresponding to the message, it performs slow-path forwarding of the message, that is, sends the message and the identifier of the virtual function of the target network interface card to receive the message to the virtual switch.
  • the virtual switch performs slow-path forwarding learning based on the identifiers of packets and virtual functions, determines the precise flow table corresponding to the packet, and then offloads the precise flow table to the target network interface card. message is processed.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same.
  • the method further includes: when the virtual switch detects that the target offload flow table stored in the first network interface card of the N network interface cards is deleted, removing the first network interface card from the N network interface cards.
  • a network interface card other than the network interface card sends a delete instruction, and the delete instruction is used to instruct to delete the stored offload flow table that is the same as the target offload flow table, and the first network interface card is the N network Any one of the network interface cards, and the target offload flow table is any one of multiple offload flow tables stored in the first network interface card.
  • the virtual switch unloads the precise flow table to all network interface cards (that is, N network interface cards) connected to the host when determining that the precise flow table corresponding to the packet satisfies the unloading condition, for N
  • N There are two network interface cards, and the offload flow tables stored in any two network interface cards are the same.
  • the offload flow table stored in the network interface card constitutes an offload flow table set, and the same offload flow table in the two offload flow table sets corresponding to any two network interface cards is associated with a corresponding accurate flow table in the accurate flow table set.
  • the first network interface card and the second network interface card are connected to the host, and the host stores accurate flow table 0a, accurate flow table 0b, accurate flow table 0c, and accurate flow table 0d that meet the unloading conditions.
  • the host may further include other precise flow tables that do not meet the unloading conditions, and other precise flow tables that do not meet the unloading conditions are not listed as examples in this embodiment of the present invention.
  • Precise flow tables are stored in the host to form an accurate flow table set. The set of precise flow tables that meet the unloading conditions stored in the host is unloaded to the network interface card, and the set of unloaded flow tables corresponding to the network interface card is generated.
  • the first network interface card stores the first set of offload flow tables
  • the second network interface card stores the second set of offload flow tables
  • the offload flow tables included in the first set of offload flow tables and the second set of offload flow tables are exactly the same, That is, the first offload flow table set includes offload flow table 1a, offload flow table 1b, offload flow table 1c, and offload flow table 1d
  • the second offload flow table set includes offload flow table 2a, offload flow table 2b, and offload flow table 2c, unload flow table 2d.
  • the offload flow table 1a is the same as the offload flow table 2a
  • the offload flow table 1b is the same as the offload flow table 1b
  • the offload flow table 1c is the same as the offload flow table 2c
  • the offload flow table 1d is the same as the offload flow table 2d.
  • the same unloading flow tables 1a and 2a both correspond to the precise flow table 0a
  • the same unloading flow tables 1b and 2b both correspond to the precise flow table 0b
  • the same unloading flow tables 1c and 2c both correspond to the precise flow table 0c
  • the same Both the offload flow tables 1d and 2d correspond to the exact flow table 0d.
  • the virtual switch When the virtual switch detects that any offload flow table stored in any one network interface card is deleted through the multi-network interface card intelligent offload engine module, the virtual switch sends the information to the N network interface cards except for the any one network interface card.
  • the network interface card sends a delete instruction to instruct other network interface cards to delete the stored offload flow table that is the same as the target offload flow table, so as to realize unified management of the offload flow table among multiple network interface cards.
  • the physical machine can link the offload flow table stored in the network interface card to the precise flow table in the virtual switch according to the linked list technology, when the precise flow table in the virtual switch is deleted or changed, and when any When the offload flow table stored in the network interface card is deleted, the host will notify the network interface card to delete or modify the offload flow table synchronously.
  • the method further includes: when the virtual switch detects a preset condition, sending an update instruction to the N network interface cards, where the update instruction is used to instruct the N network interface cards
  • the network interface card updates the offload flow table associated with the target message
  • the preset conditions include the change of the slow-path forwarding rule corresponding to the target message, the aging of the connection of the target message, the deletion of the virtual machine port, and the transmission control protocol.
  • TCP Transmission Control Protocol
  • the virtual switch unloads the updated precise flow table to N network interface cards to indicate the N network interface cards
  • the original offload flow table corresponding to the message is updated based on the accurate flow table corresponding to the newly offloaded message, so as to realize unified management of the offload flow table among multiple network interface cards.
  • a TCP connection refers to a network connection established between a client and a physical machine.
  • the client first sends a handshake signal, the physical machine responds with SYN+ACK to indicate that it has received the message, and finally the client responds with an ACK message.
  • Detecting the TCP connection state can include receiving a TCP link establishment request and receiving a request for TCP deletion of a link. Once it is found to be a deletion request, the network interface card can delete the offload flow table corresponding to the message sent by the client to avoid take up space.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same, and the method further includes: when the virtual switch detects that the state of the second network interface card among the N network interface cards is abnormal, releasing the logical port corresponding to the second network interface card from the Aggregation of logical ports corresponding to other network interface cards except the second network interface card in the N network interface cards, where the second network interface card is any one of the N network interface cards;
  • the virtual switch sends a marking instruction to the second network interface card, and releases the offload flow table stored in the second network interface card and the precise flow table included in the precise
  • the virtual switch unloads the precise flow table to all network interface cards (that is, N network interface cards) connected to the host when determining that the precise flow table corresponding to the packet satisfies the unloading condition, for N
  • N There are two network interface cards, and the offload flow tables stored in any two network interface cards are the same.
  • the precise flow table offloaded to the network interface card becomes the offload flow table stored in the network interface card.
  • the offload flow table stored in the network interface card constitutes the offload flow table set, and the two offload flow table sets corresponding to any two network interface cards The same offload flow table association.
  • the first network interface card and the second network interface card are connected to the host, the virtual switch internally stores a precise flow table set, and the precise flow table that meets the unloading condition in the precise flow table set is unloaded to the first network interface card to form the first network interface card.
  • the offload flow table set is offloaded to the second network interface card to form a second offload flow table set.
  • the first offload flow table set and the offload flow table included in the second offload flow table set are exactly the same, that is, the first offload flow table set It includes offload flow table 1a, offload flow table 1b, offload flow table 1c, and offload flow table 1d.
  • the second offload flow table set includes offload flow table 2a, offload flow table 2b, offload flow table 2c, and offload flow table 2d.
  • the offload flow table 1a is the same as the offload flow table 2a
  • the offload flow table 1b is the same as the offload flow table 1b
  • the offload flow table 1c is the same as the offload flow table 2c
  • the offload flow table 1d is the same as the offload flow table 2d.
  • the precise flow table set stored in the virtual switch includes precise flow tables that satisfy the unloading conditions, including: precise flow table 0a, precise flow table 0b, precise flow table 0c, and precise flow table 0d.
  • the host may further include other precise flow tables that do not meet the unloading conditions, and other precise flow tables that do not meet the unloading conditions are not listed as examples in this embodiment of the present invention.
  • the virtual switch associates the same offload flow table 1a and the same offload flow table 2a to the precise flow table 0a through the multi-network interface card intelligent offload module, and the same offload flow table 1b and the same offload flow table 2b are associated with the precise flow table 0b, the same offload flow table 0b.
  • the flow table 1c and the offload flow table 2c are associated with the accurate flow table 0c, and the offload flow table 1d and the offload flow table 2d are associated with the accurate flow table 0d, so that the virtual switch can realize the multi-network interface card offload flow through the multi-network interface card intelligent offload module. table management. For example, when the virtual switch detects that the state of the second network interface card is abnormal through the virtual switch binding module, on the one hand, the virtual switch binding module releases the logical port corresponding to the second network interface card from being corresponding to the first network interface card.
  • the virtual switch sends a marking instruction to the second network interface card to instruct the second network interface card to add the offload flow table 1a and the offload flow table 1b included in the second offload flow table set , the offloading flow table 1c and the unloading flow table 1d are marked as invalid; and through the multi-NIC intelligent offloading engine module, the offloading flow table 1a and the precise flow table 0a are disassociated, the unloading flow table 1b and the precise flow table 0b are disassociated, and the unloading The association between the flow table 1c and the precise flow table 0c is released, and the association between the unloaded flow table 1d and the precise flow table 0d is cancelled.
  • the offload flow table marked as invalid is reclaimed by the aging thread.
  • the virtual switch sets the virtual function link state of the abnormal network interface card to down through the virtual switch binding module, thereby triggering the virtual function state of the abnormal network interface card to be down, and then executes the virtual function through the virtual switch binding module.
  • the switching of function-related links is switched to other network interface cards connected to the host, and other network interface cards complete IO communication to ensure the reliability of the link.
  • the method further includes: when the second network interface card is in a normal state, the virtual switch associates the logical port corresponding to the second network interface card with the other network interface card Corresponding logical port aggregation; the virtual switch unloads the precise flow table in the precise flow table set to the second network interface card, wherein the precise flow table unloaded to the second network interface card constitutes the an offload flow table set corresponding to the second network interface card; the virtual switch establishes the offload flow table included in the offload flow table set corresponding to the second network interface card and the exact flow table set that meets the offload condition.
  • the virtual switch associates the logical port corresponding to the second network interface card with the other network interface card Corresponding logical port aggregation; the virtual switch unloads the precise flow table in the precise flow table set to the second network interface card, wherein the precise flow table unloaded to the second network interface card constitutes the an offload flow table set corresponding to the second network interface card; the virtual switch establishes the offload flow table included in the offload
  • the virtual switch binding module of the virtual switch detects that the network interface card in an abnormal state returns to normal, the physical ports inside the network interface card are aggregated based on the link aggregation control protocol LACP to form a logical port to form a first-level logical port Binding; the virtual switch binding module sets the logical port corresponding to the network interface card and the logical port corresponding to the other network interface card as the corresponding target port identifier, so as to restore the aggregation of the network interface card and other network interface cards, that is, Restore second level binding.
  • the virtual switch uses the multi-network interface card intelligent offload module to transfer the precise flow table stored in the virtual switch.
  • the precise flow table in the table set is unloaded to the network interface card whose state has returned to normal, and the mapping relationship between the unloaded flow table set corresponding to the network interface card and the precise flow table set is established, so as to realize the corresponding network interface card whose state has returned to normal.
  • the offload flow table set is associated with the exact flow table set and the same flow table in the offload flow table set corresponding to the other network interface cards, so as to realize unified management of offload flow tables among multiple network interface cards.
  • the management of the offload flow table of multiple network interface cards can be realized, that is, the creation, aging, and deletion of the offload flow table of multiple network interface cards can be realized, and the consistency check of the offload flow table among different network interface cards can be supported.
  • the target virtual machine when the working mode of the virtual network card of the target virtual machine is configured as a soft pass-through mode, the target virtual machine sends a packet to the target network interface card, further comprising: the The target virtual machine configures the number of queues of the virtual network card to be K, and divides the data flow to be sent into K queues, wherein the data flow includes the message, and the message included in the data flow matches the same offload flow table ; the virtual switch receives the data stream sent by the target virtual machine through the second port; the virtual switch sends the data stream to N virtual functions corresponding to the N network interface cards, wherein , each virtual function is responsible for receiving the data flow of K/N queues, so that the target network interface card queries whether there is an offload flow table corresponding to the message according to the data flow of K/N queues, K is Integer multiple of N, the data flow is directly copied from the memory of the target virtual machine to the memory of the N network interface cards based on the correspondence between the K queues of the virtual network card
  • the sending of the message by the target virtual machine to the network interface card may include that the target virtual machine sends the message to the target network interface card among the N network interface cards, and the target network interface card completes the processing of the message.
  • Sending the message by the target virtual machine to the network interface card may further include that the target virtual machine sends a message to a plurality of network interface cards in the N network interface cards, and the plurality of network interface cards jointly complete the processing of the message, so as to speed up the message processing efficiency.
  • the target virtual machine takes the target virtual machine sending a message to N network interface cards, and the N network interface cards jointly complete the processing of the message as an example, the virtual network card of the virtual machine is configured with the number of queues K, in the target virtual machine
  • the target virtual machine sends packets to the soft pass-through module of the virtual switch.
  • the soft passthrough module accepts packets sent by the target virtual machine in a zero-copy manner.
  • the soft pass-through module sends packets to N virtual functions corresponding to N network interface cards through the VF bond module. Each virtual function is responsible for forwarding packets in K/N queues.
  • a corresponding relationship is established between the K queues of the virtual network card and the queues composed of N virtual functions corresponding to the N network interface cards.
  • zero-copy specifically means that the message is directly copied from the memory of the target virtual machine to the memory of the network interface card, and the virtual switch receives the message through the second port and sends the message to the network interface card. No message copying is performed when the virtual function is described.
  • the packets need to be transported by the virtual switch, so generally, the packets need to be copied to the memory of the host before Copy from the host's memory to the network interface card.
  • the queue of the virtual machine virtual network card and the queue of the virtual function of the network interface card have a corresponding relationship.
  • the soft pass-through module directly Map the memory of the virtual machine to the memory of the network interface card, that is, the network interface card can directly perform Direct Memory Access (DMA) on the memory of the virtual machine, and bind the queue of the virtual network card to the queue of the hardware network card VF. Achieve zero-copy message transmission.
  • DMA Direct Memory Access
  • the target virtual machine receives the message sent by the network interface card
  • the message is directly copied from the memory of the network interface card to the memory of the target virtual machine
  • the virtual switch receives the message sent by the network interface card through the second port.
  • the virtual switch does not copy the message.
  • the product form of the embodiment corresponding to FIG. 7 may be included in the software of the physical machine and deployed on the computing node of the cloud platform.
  • the program code of the embodiment corresponding to FIG. 7 may run in the host memory of the physical machine and the hardware memory of the network interface card.
  • FIG. 8 is a schematic flowchart of another flow table processing method provided by an embodiment of the present invention.
  • the method can be applied to the virtual switch 102 in the physical machine architecture described in FIG. 5, wherein the virtual switch 102 It can be used to support and execute the method flow steps S801 and S802 shown in FIG. 8 .
  • the following description will be made from a single side of the virtual switch with reference to FIG. 8 .
  • the virtual switch connects M virtual machines and N network interface cards, where M and N are integers greater than or equal to 2.
  • the method may include the following steps S803 and S804, and optionally, may also include steps S805-S807 .
  • Step S801 the virtual switch establishes a mapping relationship between the N port identifiers of the N logical ports and the target port identifiers, so as to aggregate the N logical ports into the first port; wherein, each network The logical port corresponding to the interface card is a logical port formed by the aggregation of the physical ports of each network interface card based on the link aggregation control protocol LACP.
  • Step S802 the virtual switch offloads the precise flow table to the N network interface cards through the first port.
  • step S802 before the above step S802 is executed, the following steps S803 and S804 may also be included.
  • Step S803 the virtual switch receives a message sent by the target network interface card, where the message carries the message received by the target network interface card and the identifier of the virtual function for which the target network interface card receives the message, and the message It is sent by the target network interface card after inquiring that there is no offload flow table corresponding to the message after receiving the message, and the target network interface card is one of the N network interface cards. one of.
  • Step S804 the virtual switch determines the precise flow table based on the packet and the identifier of the virtual function of the target network interface card to receive the packet, where the precise flow table is used to indicate the processing of the packet .
  • Step S805 the virtual switch receives the message sent by the target virtual machine through a second port, where the target virtual machine is any one of the M virtual machines, and the second port is the N network interface cards
  • the corresponding N virtual functions are aggregated in the virtual switch to form logical ports.
  • Step S806 the virtual switch determines a target virtual function from the N virtual functions corresponding to the N network interface cards.
  • Step S807 the virtual switch sends the message to the target virtual function, so that the target network interface card corresponding to the target virtual function queries whether there is an offload flow corresponding to the message according to the message surface.
  • the method further includes the following step S808: the virtual switch determines that the precise flow table satisfies the unloading condition.
  • the determining that the precise flow table satisfies the unloading condition includes: determining, according to the packet corresponding to the precise flow table, that the connection state between the virtual machine sending the packet and the virtual switch is stable; and/or according to the packet corresponding to the precise flow table The message corresponding to the precise flow table determines that the flow rate of the virtual machine that sends the message is greater than or equal to a preset threshold.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same, and the method further includes: when the virtual switch detects that the target offload flow table stored in the first network interface card of the N network interface cards is deleted, removing the target offload flow table from the N network interface cards Other network interface cards other than the first network interface card send a deletion instruction, and the deletion instruction is used to instruct to delete the stored offload flow table that is the same as the target offload flow table, and the first network interface card is the N Any one of the network interface cards, and the target offload flow table is any one of a plurality of off
  • the method further includes: when the virtual switch detects a preset condition, sending an update instruction to the N network interface cards, where the update instruction is used to instruct the N network interface cards
  • the card updates the offload flow table associated with the target message
  • the preset conditions include the change of the slow-path forwarding rule corresponding to the target message, the aging of the connection of the target message, the deletion of the virtual machine port, and the transmission control protocol TCP connection.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same, and the method further includes: when an abnormal state of the second network interface card among the N network interface cards is detected, releasing the logical port corresponding to the second network interface card from the N network interfaces Aggregation of logical ports corresponding to other network interface cards in the card except the second network interface card, where the second network interface card is any one of the N network interface cards; to the second network interface card
  • the network interface card sends a marking instruction, and releases the one-to-one correspondence between the offload flow table stored in the second network interface card and the precise flow
  • the method further includes: when the state of the second network interface card is normal, associating the logical port corresponding to the second network interface card with the logical port corresponding to the other network interface card Aggregation; unloading the precise flow table in the precise flow table set to the second network interface card, wherein the precise flow table unloaded to the second network interface card constitutes the offloading corresponding to the second network interface card A flow table set; establishing a mapping relationship between the offload flow table set corresponding to the second network interface card and the precise flow table set.
  • the method before the receiving the message sent by the target network interface card, the method further includes: receiving, through the second port, a data stream sent by the target virtual machine, where the data stream includes the data stream sent by the target virtual machine.
  • the packets included in the data flow match the same offload flow table, and the data flow is divided into K queues; send the data flow to N virtual functions corresponding to the N network interface cards , wherein each virtual function is responsible for the reception of data flows of K/N queues, so that the target network interface card queries whether there is an offload flow table corresponding to the message according to the data flows of K/N queues, K is an integer multiple of N, the virtual network card of the target virtual machine is configured as K queues, and the data flow is determined by the target virtual machine based on the correspondence between the K queues of the virtual network card and the N virtual functions
  • the memory of the machine is directly copied to the memory of the N network interface cards, so as to realize zero-copy transmission of the data stream from the target virtual machine to the N network interface cards.
  • an embodiment of the present invention provides a schematic flowchart of yet another flow table processing method.
  • the virtual switch here is an eVS
  • the network interface card is a Hi1822 network interface card.
  • the virtual network card is configured in soft pass-through mode, and the flow table processing method includes steps (1) to (6).
  • the physical machine creates the vSW network Bond topology.
  • a physical machine creates a vSW object, constructs a topology of the virtual switch by creating a virtual switch object on the virtual switch framework, and adds one or more ports to the virtual switch to form the topology. Among them, the creation of the vSW object is consistent with the existing process, and will not be repeated here.
  • the two LACP aggregations Hwbond-A and Hwbond-B are set to correspond to the target port identifier sysid; at the second level, the eVS abstracts and merges the two LACP aggregations into a 4-port LACP aggregation at the software level.
  • the physical machine switch also enables the dynamic LACP technology accordingly. Since the two LACP aggregations corresponding to the two network interface cards are set to correspond to the target port identifier sysid, a 4-port LACP can also be negotiated on the physical switch side. polymerization.
  • the physical machine initializes the multi-network interface card intelligent offload engine module.
  • the physical machine initialization multi-network interface card intelligent offload engine includes: (a) initializing the hardware datapath module of each network interface card, that is, the first hardware datapath module included in the first network interface card and the first hardware datapath module included in the second network interface card. Two hardware datapath modules; (b) assigning a network interface card identifier to each network interface card, the network interface card identifier is used to indicate from which network interface card the data flow is received and the association relationship between the offload flow table and the network interface card .
  • the network interface card is interconnected with the virtual machine through the network interface card port, one network interface card port can be connected to a virtual machine running on the host through the SR-I/OV technology, and the network interface card port can be SR-I/OV technology. Ports of virtual functions defined by I/OV technology.
  • the network interface card may also use other technologies to interconnect with the virtual machine, and the embodiment of the present invention does not limit the technology for interconnecting the network interface card and the virtual machine.
  • the network interface card may also be a network interface card that supports the virtual machine device queue (Virtual Machine Device Queues, VMDq) function. Configuring a physical machine to configure a port for interconnecting a virtual machine with a network interface card can include the following steps:
  • the host of the physical machine establishes at least one virtual switch port on the virtual switch according to the configuration information of the virtual switch port, and each virtual switch port corresponds to a virtual machine running on the host.
  • each virtual switch port corresponds to a virtual machine running on the host.
  • the virtual network card corresponding to the first virtual machine is virtual network card 1
  • the virtual network card corresponding to the second virtual machine is virtual network card 2
  • the virtual switch has ports 1 and 1. Port 2 then set port 1 to correspond to virtual network card 1, and set port 2 to correspond to virtual network card 2, that is, different ports of the virtual switch correspond to different virtual network cards and then correspond to different virtual machines.
  • the host generates configuration information of the network interface card port, and sends the configuration information of the network interface card port to the network interface card of the physical machine. Specifically, the host obtains the configuration information of the virtual switch port, sends the configuration information of the virtual switch port to the network interface card driver running on the host, and the network interface card driver generates the network interface card driver according to the configuration information of the virtual switch port. The configuration information of the interface card port is sent to the network interface card.
  • the configuration information of the virtual switch port is similar in function to the configuration information of the network interface card port.
  • the network interface card driver converts the configuration information of the virtual switch port into the configuration information of the network interface card port mainly in order to conform to the network interface card driver and the network interface card. Specification for interface card communication.
  • the network interface card configures at least one network interface card port on the network interface card according to the configuration information of the network interface card port, and each network interface card port is connected to a virtual machine running on the host.
  • the physical machine allocates a virtual function from each of the two network interface cards and binds it to the virtual network card of the virtual machine.
  • the network interface card port may be a port of a virtual function defined by the SR-I/OV technology. Therefore, each port of the virtual switch corresponds to a virtual function of the network interface card, and the network interface card is interconnected with the virtual machine through the virtual function.
  • steps (a) to (c) are optional steps, and steps (a) to (c) are the configuration process of the virtual switch and the network interface card, and there is no need to perform the subsequent steps of (a) to (c) each time. Execute (a) to (c) once before. Through this configuration process, the virtual machines running on the host are connected to the network interface card through the network interface card port.
  • creating a virtual machine instance by the physical machine further includes configuring at least one queue for communication between the virtual switch and the network interface card, so that the virtual switch returns the data packets received from the network interface card to the network interface card.
  • the configuration of the queue can take many forms.
  • the virtual switch communicates with the network interface card through a queue, and the virtual switch sends all the packets that need to be sent to the network interface card to the queue.
  • the virtual switch communicates with the network interface card.
  • the network interface card communicates through K queues, where K is an integer multiple of the number N of network interface cards, and each queue corresponds to one network interface card.
  • the embodiment of the present invention does not limit the configuration form of the queue.
  • the working modes of the virtual network card of the virtual machine include a soft pass-through working mode and a hard pass-through working mode. Regardless of whether the working mode of the virtual network card is configured as soft pass-through or hard pass-through, packet forwarding can be divided into slow-path forwarding and fast-path forwarding. Considering the working mode of the virtual network card and the forwarding of packets, the forwarding paths of packets are summarized as shown in the following 11.
  • any virtual machine 101 can be used as the source virtual machine in FIG. 11 to send packets to other virtual machines 101 , and any virtual machine 101 can also be used as the destination virtual machine to receive messages from other virtual machines. 's message.
  • any one of the network interface cards 105 can be used as the first network interface card and the second network interface card in this application.
  • the virtual NIC backend device performs the binding operation.
  • the physical machine also utilizes a multi-queue mechanism, and when the virtual network card of the virtual machine is configured with a number of queues of M (an even number is recommended), each virtual function of the VF Bond module in the Soft Passthrough is responsible for M.
  • the Virtio virtual network card and virtual function queues establish a one-to-one correspondence
  • the soft pass-through module sends and receives packets in a zero-copy manner.
  • the physical machine performs the first packet slow path learning.
  • a certain virtual function is selected based on the hash algorithm through the internal VM bond, and the virtual function is extended. network interface card.
  • the virtual network card of the virtual machine is configured as the soft pass-through working mode
  • the message first reaches the soft pass-through module of the virtual switch, and the soft pass-through module passes the internal VF bond based on the hash algorithm. Select a certain virtual function, and then reach the hardware network interface card that extends the virtual function, wherein, FIG.
  • FIG. 10 only illustrates the scenario where the virtual network card of the first virtual machine is configured in the hard pass-through working mode. Scenarios configured for soft pass-through mode of operation are not shown in FIG. 10 .
  • the hardware network interface card generates a message, a hardware upcall.
  • the hardware upcall carries the packet and the virtual function identifier, and the vSW receives the packet through the corresponding virtual NIC proxy port.
  • the vSW forwards packets on the software slow path through the software slow path module, performs logic such as security check, status update, and destination location search, and notifies the multi-network interface card intelligent offload engine module of the result.
  • the multi-network interface card intelligent offload engine module intelligently decides whether to generate the offload flow table according to the status, the packet execution action set and the traffic size. If not, the offload is abandoned. If the offload flow table can be installed, the multi-network interface card intelligent offload engine module simultaneously delivers the exact current-carrying table corresponding to the packet to the hardware datapath modules of all network interface cards connected to the virtual switch, and the multi-network interface card
  • the intelligent offloading engine module records the relationship between the offload flow table and the network interface card identifier, and the relationship between the same offload flow tables corresponding to different network interface cards.
  • the action set of the message is divided into two parts, the first part is used to indicate how to modify the message header of the message, and the second part is used to indicate the port from which the network interface card message is sent.
  • the first virtual machine sends a message
  • the virtual network card of the first virtual machine is configured as a hard pass-through working mode, as shown in 10
  • a certain virtual function is selected based on the Hash algorithm through the internal VM bond of the first virtual machine, and the extension is reached. out the network interface card of the virtual function.
  • the virtual network card of the virtual machine is configured in the soft pass-through working mode
  • the packet arrives at the soft pass-through module of the virtual switch, and the soft pass-through module selects a certain virtual function based on the hash algorithm through the internal VF bond , and then reach the network interface card that extends the virtual function.
  • the offload flow table is searched inside the hardware datapath module of the network interface card, and based on the offload flow table corresponding to the packet, the packet is directly forwarded to other virtual machines or external networks.
  • 10 only illustrates a scenario in which the virtual network card of the first virtual machine is configured in the hard pass-through working mode and the virtual network card of the second virtual machine is configured in the soft pass-through working mode, and other scenarios are not shown in FIG. 10 .
  • the offload flow table change includes the following triggering conditions: slow path forwarding rule change, packet connection aging, virtual machine port deletion, TCP connection state change, and the like.
  • the multi-network interface card intelligent offload engine module detects the above triggering condition, it offloads the updated precise flow table to the network interface card connected to the virtual switch.
  • the associated offload flow tables in other network interface cards connected to the virtual switch except the above network interface card are cleaned up at the same time.
  • the vSW-Bond module When the vSW-Bond module detects that a certain network interface card is in an abnormal state (cannot work), it will remove the abnormal network interface card from the Bond, and immediately notify the multi-network interface card intelligent unloading engine module.
  • the multi-network interface card intelligent offload engine module searches the internal accurate flow table, marks the accurate flow table corresponding to the abnormal state of the network interface card as invalid, and disconnects other network interfaces connected to the virtual switch except the abnormal state of the network interface card. The association of the associated offload flow table on the card. Offload flow tables marked as invalid are eventually reclaimed and released by the aging thread.
  • the vSW-Bond module rejoins it to Bond and notifies the multi-NIC intelligent offload engine module.
  • the multi-NIC intelligent offload engine module copies a copy of the offload flow table of another network interface card, sends it to the network interface card that resumes normal work, and records the network interface card identifier of the network interface card that resumes normal work and the offload flow table. connection relation.
  • FIG. 12 is a schematic structural diagram of a flow table processing apparatus 900 provided by an embodiment of the present invention.
  • the flow table processing apparatus may include a establishing unit 901 and an unloading unit 902, wherein the detailed description of each unit is as follows.
  • each The logical port corresponding to the network interface card is a logical port formed by the aggregation of the physical ports of each network interface card based on the link aggregation control protocol LACP.
  • the offloading unit 902 is configured to offload the precise flow table corresponding to the packet to the N network interface cards through the first port.
  • the apparatus further includes.
  • the first receiving unit 903 is configured to receive a message sent by the target network interface card, where the message carries the message received by the target network interface card and the identifier of the virtual function for the target network interface card to receive the message,
  • the message is sent by the target network interface card after inquiring that there is no offload flow table corresponding to the message after receiving the message, and the target network interface card is the N network interfaces. one of the cards.
  • the determining unit 904 is configured to determine an accurate flow table corresponding to the message based on the message and the identifier of the virtual function for receiving the message by the target network interface card.
  • the apparatus further includes:
  • the second receiving unit 905 is further configured to receive the message sent by the target virtual machine through a second port, where the target virtual machine is any one of the M virtual machines, and the second port is the N A logical port formed by aggregation of N virtual functions corresponding to the network interface cards in the virtual switch;
  • the determining unit 904 is further configured to determine a target virtual function from the N virtual functions corresponding to the N network interface cards;
  • the device also includes:
  • a sending unit 906 configured to send the message to the target virtual function, so that the target network interface card corresponding to the target virtual function queries whether there is an offload corresponding to the message according to the message flow table.
  • the unloading unit 902 is further configured to determine that the precise flow table corresponding to the packet satisfies the unloading condition.
  • the unloading unit 902 is specifically configured to: determine the connection state between the virtual machine sending the message and the virtual switch according to the message and/or according to the message, it is determined that the flow rate of the virtual machine sending the message is greater than or equal to a preset threshold.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same
  • the device further includes a first update unit 907, and the first update unit 907 is configured to, when detecting that the target offload flow table stored in the first network interface card of the N network interface cards is deleted, Send a deletion instruction to the N network interface cards except the first network interface card, where the deletion instruction is used to instruct to delete the stored unloading flow table that is the same as the target unloading flow table, so
  • the first network interface card is any one of the N network interface cards
  • the target offload flow table is any one of a plurality
  • the apparatus further includes a second update unit 908, and the second update unit 908 is configured to send an update instruction to the N network interface cards when a preset condition is detected, and the update The instruction is used to instruct the N network interface cards to update the offload flow table associated with the target packet, and the conditions include that the slow path forwarding rule corresponding to the target packet is changed, the connection of the target packet is aging, the virtual machine One or more of port deletion and Transmission Control Protocol TCP connection state change.
  • the precise flow table stored in the virtual switch forms a precise flow table set
  • the offload flow table stored in each of the N network interface cards forms an offload flow table set
  • the offloading flow table included in each offloading flow table set has a one-to-one correspondence with the precise flow table included in the precise flow table set that satisfies the unloading condition
  • the N offloading flow table sets in the N offloading flow table sets correspond to the same precise flow table
  • the flow table is the same
  • the device further includes a third update unit 909, and the third update unit 909 is configured to release the second network interface card when an abnormal state of the second network interface card among the N network interface cards is detected.
  • the third update unit 909 is further configured to interface the logical port corresponding to the second network interface card with the other network interface when the second network interface card is in a normal state
  • the logical ports corresponding to the card are aggregated; the precise flow table in the precise flow table set is unloaded to the second network interface card, wherein the precise flow table unloaded to the second network interface card constitutes the second network
  • the offload flow table set corresponding to the interface card establishing a one-to-one correspondence between the offload flow table included in the offload flow table set corresponding to the second network interface card and the precise flow table included in the precise flow table set that satisfies the offload condition relation.
  • the second receiving unit 905 is further configured to receive, through the second port, a data stream sent by the target virtual machine, where the data stream includes the packet, and the data stream The packets included in the packet match the same offload flow table, and the data flow is divided into K queues.
  • the sending unit 906 is further configured to send the data stream to N virtual functions corresponding to the N network interface cards, wherein each virtual function is responsible for receiving data streams of K/N queues, so that The target network interface card queries whether there is an offload flow table corresponding to the message according to the data flow of the K/N queues, where K is an integer multiple of N, and the virtual network card of the target virtual machine is configured as K queues, the data flow is directly copied from the memory of the target virtual machine to the memory of the N network interface cards based on the correspondence between the K queues of the virtual network card and the N virtual functions to realize the Zero-copy transmission of data streams from the target virtual machine to the N network interface cards.
  • FIG. 13 is a schematic structural diagram of a physical machine 10 according to an embodiment of the present invention.
  • the physical machine 10 includes at least one processor 601 , at least one memory 602 , and at least one communication interface 603 .
  • the device may also include general components such as an antenna, which will not be described in detail here.
  • the processor 601 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the above programs.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication interface 603 is used to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), core network, wireless local area network (Wireless Local Area Networks, WLAN) and the like.
  • RAN radio access network
  • WLAN wireless Local Area Networks
  • the memory 602 may be read-only memory (ROM) or other type of static storage device that can store static information and instructions, random access memory (RAM) or other type of static storage device that can store information and instructions It can also be an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being executed by a computer Access any other medium without limitation.
  • the memory can exist independently and be connected to the processor through a bus.
  • the memory can also be integrated with the processor.
  • the memory 602 is used for storing the application code for executing the above solution, and the execution is controlled by the processor 601 .
  • the processor 601 is configured to execute the application code stored in the memory 602 .
  • the code stored in the memory 602 can execute the flow table processing method provided in FIG. 5 above, such as establishing a mapping relationship between the N port identifiers of the N logical ports corresponding to the N network interface cards and a target port identifier, so as to The N logical ports are aggregated into a first port; wherein, the logical port corresponding to each network interface card is a logical port formed by the aggregation of physical ports of each network interface card based on the link aggregation control protocol LACP; The port offloads the precise flow table corresponding to the message to the N network interface cards.
  • the flow table processing method provided in FIG. 5 above, such as establishing a mapping relationship between the N port identifiers of the N logical ports corresponding to the N network interface cards and a target port identifier, so as to The N logical ports are aggregated into a first port; wherein, the logical port corresponding to each network interface card is a logical port formed by the aggregation of physical ports of each network interface card
  • the disclosed apparatus may be implemented in other manners.
  • the device embodiments described above are only illustrative.
  • the division of the above-mentioned units is only a logical function division.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical or other forms.
  • the units described above as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated units are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions to enable a computer device (which may be a personal computer, a server, or a network device, etc., specifically a processor in the computer device) to execute all or part of the steps of the above methods in various embodiments of the present application.
  • a computer device which may be a personal computer, a server, or a network device, etc., specifically a processor in the computer device
  • the aforementioned storage medium may include: U disk, mobile hard disk, magnetic disk, optical disk, Read-Only Memory (Read-Only Memory, abbreviation: ROM) or Random Access Memory (Random Access Memory, abbreviation: RAM), etc.
  • a medium that can store program code may include: U disk, mobile hard disk, magnetic disk, optical disk, Read-Only Memory (Read-Only Memory, abbreviation: ROM) or Random Access Memory (Random Access Memory, abbreviation: RAM), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种流表处理方法及相关设备，该方法应用于虚拟交换机，该虚拟交换机连接M个虚拟机和N个网络接口卡，该方法可包括：建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与一目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；通过所述第一端口将精确流表卸载至所述N个网络接口卡。采用本发明实施例可以实现多网络接口卡的转发与卸载，提高系统的可靠性。

Description

一种流表处理方法及相关设备
本申请要求于2020年10月31日提交中国专利局、申请号为202011206451.2、申请名称为“一种流表处理方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，尤其涉及一种流表处理方法及相关设备。
背景技术
传统数据中心，一台服务器或物理机或主机运行一个操作系统，物理机与物理交换机相连，由物理交换机实现不同主机之间的数据转发。在计算虚拟化后，一台主机被虚拟化成多台虚拟机(Virtual Machine，VM)，同一主机内的虚拟机通过虚拟交换机(Virtual Switch，VSw)，例如通过虚拟交换机实现数据转发。
每个物理机上的硬件资源至少需要支持运行多个虚拟机和虚拟交换机。每台物理机的硬件资源有限，如果负担了数据交换任务的虚拟交换机占用的硬件资源太多，则容易影响物理机上虚拟机的运行，降低工作效率，降低物理机的可靠性，可能会带来处理速度慢等缺陷，甚至可能会因为物理机负担过大导致系统故障。
为了减少对物理机硬件资源的占用，虚拟交换机逐步经历了内核态软交换、用户态软交换和硬件卸载交换三个阶段。其中，硬件卸载交换技术目前逐渐得到主流厂商的使用。在硬件卸载交换技术中主机中的一些I/O业务卸载至低成本的异构硬件中执行，如此可以释放主机中中央处理器(Central Processing Unit，CPU)资源，提高CPU的运行效率。举例来说，为了进一步提高报文处理的速度以及释放CPU资源，可以将流表的匹配操作卸载到硬件上，继而将原本在主机执行的流表匹配操作卸载到硬件中实现。这些用于卸载输入/输出(Input/Output，I/O)业务的异构硬件包括网络接口卡，也可以被称为卸载卡。然而，硬件卸载交换技术中存在跨网络接口卡可靠性问题，即只能实现单一网络接口卡内不同链路的可靠性，如果该网络接口卡故障，那么整个系统就故障了，存在单点故障的风险。
发明内容
本发明实施例提供一种流表处理方法及相关设备，以解决硬件卸载交换技术中存在的跨网络接口卡可靠性的问题。
第一方面，本发明实施例提供了一种流表处理方法，该流表处理方法应用于虚拟交换机，所述虚拟交换机连接M个虚拟机和N个网络接口卡，M、N为大于或者等于2的整数，该流表处理方法可包括：建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与一目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；通过所述第一端口将精确流表卸载至所述N个网络接口卡。
现有技术中仅存在基于虚拟交换机和单一网络接口卡的精确流表卸载方案，因此存在单点故障的风险。然而，即使基于现有技术将虚拟交换机和多个网络接口卡连接也无法实现报文的有效处理。若基于现有技术将虚拟交换机和多个网络接口卡连接，由于不同的网 络接口卡对应不同的逻辑端口标识，不同的逻辑端口标识意味着多个网络接口卡对应多个不同的逻辑链路，那么此时在物理交换机和虚拟交换机之间可能会基于多个网络接口卡对应的多个不同的逻辑链路形成数据回环。举例来说，多个网络接口卡中的第一网络接口卡收到一仅能基于虚拟交换机进行处理的广播报文(例如地址解析协议(Address Resolution Protocol,ARP)报文)时，该报文可以是虚拟机发送至第一网络接口卡的也可以是其它物理机通过物理交换机发送至该第一网络接口卡的，此类报文由于没有五元组因此其对应的精确流表是不能卸载至网络接口卡，必须基于虚拟交换机进行报文广播，因此第一网络接口卡在接收到ARP报文后会将该ARP报文上送至虚拟交换机。其中，假如该ARP报文是其它物理机经由物理交换机发送至第一网络接口卡的，那么第一网络接口卡在将该ARP报文经由第一网络接口卡对应的逻辑链路上送至虚拟交换机后，由于第一网络接口卡和多个网络接口卡中的第二网络接口卡对应不同的逻辑链路，那么虚拟交换机会将该ARP报文经过第二网络卡对应的逻辑链路再次广播至物理交换机，至此该ARP报文在虚拟交换机和物理交换机之间产生数据回环。假如该报文是其他虚拟机发送至第一网络接口卡的，那么第一网络接口卡在将该ARP报文经由第一网络接口卡对应的逻辑链路上送至虚拟交换机后，虚拟交换机会将该报文经过第二网络卡对应的逻辑链路广播至物理交换机，物理交换机接收到该ARP报文后会通过第一网络卡对应的逻辑链路再次广播至虚拟交换机，至此该ARP报文也会在虚拟交换机和物理交换机之间产生数据回环。物理交换机和虚拟交换机之间数据回环影响系统的性能甚至会导致报文处理异常。
在本发明实施例中，每个网络接口卡内部的物理端口基于链路汇聚控制协议LACP聚合形成逻辑端口，以形成第一级绑定；其次，虚拟交换机建立所述N个逻辑端口的N个端口标识与所述目标端口标识之间的映射关系，从而将N个网络接口卡对应的N个逻辑端口设置为对应同一个目标端口标识，以形成第二级绑定。一方面，本发明实施例通过上述两级绑定形成的第一端口可以避免N个逻辑端口分别对应不同的端口标识所可能导致的物理交换机和虚拟交换机之间数据回环。本发明实施例中N个逻辑端口的N个端口标识与一相同的目标端口标识对应，那么从交换机侧看，N个网络接口卡对应一条逻辑链路，进而可以避免处理类似ARP报文时不同逻辑链路所导致的物理交换机和虚拟交换机之间之间的数据回环；另一方面，本发明实施例通过上述两级绑定形成的第一端口实现了精确流表的多网络接口卡卸载，即虚拟交换机在确定所述精确流表满足卸载条件的情况下，可以通过第一端口将所述精确流表卸载至所述所有的网络接口卡，从而解决了在将精确流表卸载到单一网络接口卡或基于单一网络接口卡进行报文处理的过程中，该单一网络接口卡故障而导致业务终止的问题，虚拟交换机将精确流表卸载至与主机连接的所有网络接口卡，使得在任一网络接口卡故障时，虚拟交换机可以切换至其它网络接口卡，从而保证报文处理业务的可靠性。
在一种可能的实现方式中，所述通过所述第一端口将所述精确流表卸载至所述N个网络接口卡之前，所述方法还包括：接收目标网络接口卡发送的消息，所述消息携带所述目标网络接口卡接收到的所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，所述消息是所述目标网络接口卡在接收到所述报文后查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表后发送的，所述目标网络接口卡是所述N个网络接口卡中的其 中一个；基于所述报文和所述虚拟功能的标识，确定所述精确流表，所述精确流表用于指示对所述报文的处理。
在本发明实施例中，目标网络接口卡在接收到目标虚拟机发送的报文且在查询到内部不存在与报文对应的卸载流表后，向虚拟交换机发送消息，虚拟交换机根据该消息确定所述精确流表，并在确定所述精确流表满足卸载条件的情况下，通过所述第一端口将所述精确流表卸载至所述N个网络接口卡，从而，一方面实现虚拟交换机对报文执行软件慢路径规则的学习，支持虚拟交换机的硬件卸载，进而支撑云计算平台丰富的业务功能诉求；另一方面，虚拟交换机将精确流表卸载至与主机连接的所有网络接口卡，使得在任一网络接口卡故障时，虚拟交换机可以切换至其它网络接口卡，从而保证报文处理业务的可靠性。
在一种可能的实现方式中，所述接收目标网络接口卡发送的消息之前，所述方法还包括：通过第二端口接收目标虚拟机发送的所述报文，所述目标虚拟机是所述M个虚拟机中的任意一个，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；将所述报文发送至所述目标虚拟功能，以使所述目标虚拟功能对应的所述目标网络接口卡根据所述报文查询是否存在与所述报文对应的卸载流表。
在本发明实施例中，在虚拟机的虚拟网卡硬直通模式(虚拟机与网络接口卡直接连接)故障时，虚拟机的虚拟网卡的工作模式配置可以被为软直通模式(虚拟机通过虚拟交换机的软直通模块与网络接口卡连接)，虚拟机发送的报文可以通过虚拟交换机搬运至目标网络接口卡，从而实现按场景按需求配置虚拟网卡的工作模式，以及在虚拟网卡硬直通故障时，切换至软直通模式继续实现报文的传输，保证业务的可靠性。
在一种可能的实现方式中，所述通过所述第一端口将所述精确流表卸载至所述N个网络接口卡之前，所述方法还包括：确定所述精确流表满足卸载条件，其中，所述确定所述精确流表满足卸载条件，包括：根据所述精确流表对应的报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或根据所述精确流表对应的报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
在本发明实施例中，由于网络接口卡的存储空间有限，难以存储大量的卸载流表。在发送报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或根据报文确定发送报文的虚拟机的流速率大于或等于预设阈值时，虚拟交换机才将所述精确流表卸载至网络接口卡，避免盲目卸载占用网络接口卡的存储空间，降低网络接口卡的报文处理效率。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。
本发明实施例中，可以根据链表技术将网络接口卡中存储的卸载流表链接到虚拟交换机中的精确流表，当虚拟交换机中的精确流表删除或更改的时候，以及当任一网络接口卡中存储的卸载流表被删除的时候，主机会通知网络接口卡同步删除或者修改卸载流表，实现所有网络接口卡中存储的卸载流表以及主机中存储的精确流表的一致性管理。
在一种可能的实现方式中，所述方法还包括：在检测到所述N个网络接口卡中的第一 网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
本发明实施例中，在检测到任意一个网络接口卡中的任一卸载流表被删除时，清理N个网络接口卡中除任意一个网络接口卡外的其它网络接口卡中关联的卸载流表，实现所有网络接口卡中存储的卸载流表的一致性管理。
在一种可能的实现方式中，所述方法还包括：在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
本发明实施例中，在检测到目标报文对应的精确流表发生变更时，指示N个网络接口卡更新与目标报文关联的卸载流表，实现精确流表和卸载流表的同步以及所有网络接口卡中存储的卸载流表的一致性管理。
在一种可能的实现方式中，所述方法还包括：在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
本发明实施例中，在检测到任意一个网络接口卡状态异常时，将状态异常的网络接口卡存储的卸载流表标记为无效，解除所述被标记为无效的卸载流表与精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，进而解除所述被标记为无效的卸载流表与其它网络接口卡中存储的卸载流表的关联，实现所有网络接口卡中存储的卸载流表的一致性管理。
在一种可能的实现方式中，所述方法还包括：当所述第二网络接口卡状态正常时，将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
本发明实施例中，在检测到任意一个网络接口卡状态恢复正常时，恢复该网络接口卡对应的虚拟功能链路以及相关卸载流表的设置，从而实现多网络接口卡之间卸载流表的统一管理。
在一种可能的实现方式中，所述接收目标网络接口卡发送的消息之前，所述方法还包括：通过所述第二端口接收所述目标虚拟机发送的数据流，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表，所述数据流被分为K个队列；将所述数据流发 送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，其中，K为N的整数倍，所述目标虚拟机的虚拟网卡被配置为K个队列，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
本发明实施例中，在虚拟机的虚拟网卡的工作模式配置为软直通模式时，虚拟机发送的报文通过虚拟交换机搬运至所有网络接口卡，且基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系实现报文传输的零拷贝，一方面提升报文的处理效率，另一方面减少主机不必要的拷贝减少，释放CPU资源，减少内存的占用。
第二方面，本发明实施例提供了一种流表处理方法，所述流表处理方法应用于物理机，所述物理机包含主机和N个网络接口卡，所述主机上运行有虚拟交换机和M个虚拟机，所述N个网络接口卡通过主机接口与主机相连，所述N个网络接口卡通过网络接口与外部网络相连，M、N为大于或者等于2的整数，所述流表处理方法可包括：所述虚拟交换机建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为所述第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；目标网络接口卡接收报文，所述报文是与物理机连接的物理交换机发送的或是目标虚拟机发送的报文，所述目标虚拟机是所述M个虚拟机中任意一个，所述目标网络接口卡是所述N个网络接口卡中的其中一个；在所述目标网络接口卡查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表的情况下，所述虚拟交换机通过所述第一端口将所述报文对应的精确流表卸载至所述N个网络接口卡。
在一种可能的实现方式中，所述方法还包括：所述目标网络接口卡在查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表时，向所述虚拟交换机发送消息，所述消息携带所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识；所述虚拟交换机基于所述报文和所述虚拟功能的标识，确定与所述报文对应的精确流表。
在一种可能的实现方式中，所述方法还包括：所述目标网络接口卡基于所述卸载的精确流表对所述报文进行处理。
在一种可能的实现方式中，所述方法还包括：在所述目标网络接口卡查询到所述目标网络接口卡中存在与所述报文对应的卸载流表时，所述目标网络接口卡基于所述卸载流表对所述报文进行处理。
在一种可能的实现方式中，当所述报文是所述目标虚拟机发送的，所述方法还包括：所述目标虚拟机向所述目标网络接口卡发送报文；所述目标虚拟机包括虚拟网卡，所述虚拟网卡的工作模式包括软直通模式和硬直通模式；
所述目标虚拟机向目标网络接口卡发送报文，包括：在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，所述目标虚拟机向所述虚拟交换机发送所述报文；所述虚拟交换机通过第二端口接收所述目标虚拟机发送的所述报文，所述第二端口为所述N个 网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；所述虚拟交换机从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；所述虚拟交换机将所述报文发送至所述目标虚拟功能；在所述目标虚拟机的虚拟网卡的工作模式被配置为硬直通模式时，所述目标虚拟机从所述N个网络接口卡对应的N个虚拟功能中确定所述目标虚拟功能；所述目标虚拟机通过第三端口向所述目标虚拟功能发送所述报文，其中，所述第三端口为所述N个虚拟功能在所述目标虚拟机内聚合形成的逻辑端口。
在一种可能的实现方式中，所述虚拟交换机通过所述第一端口将所述报文对应的精确流表卸载至所述N个网络接口卡之前，所述方法还包括：所述虚拟交换机确定所述报文对应的精确流表满足卸载条件；其中，所述虚拟交换机确定所述报文对应的精确流表满足卸载条件，包括：所述虚拟交换机根据所述报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或所述虚拟交换机根据所述报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。
在一种可能的实现方式中，所述方法还包括：所述虚拟交换机在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
在一种可能的实现方式中，所述方法还包括：所述虚拟交换机在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
在一种可能的实现方式中，所述方法还包括：所述虚拟交换机在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；所述虚拟交换机向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
在一种可能的实现方式中，所述方法还包括：当所述第二网络接口卡状态正常时，所述虚拟交换机将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；所述虚拟交换机将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集 合；所述虚拟交换机建立所述第二网络接口卡对应的卸载流表集合与中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
在一种可能的实现方式中，在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，所述目标虚拟机向所述目标网络接口卡发送报文，还包括：所述目标虚拟机配置虚拟网卡的队列数为K并将待发送的数据流分为K个队列，其中，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表；所述虚拟交换机通过所述第二端口接收所述目标虚拟机发送的所述数据流；所述虚拟交换机将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，K为N的整数倍，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
第三方面，本发明实施例提供了一种流表处理装置，所述流表处理装置应用于虚拟交换机，所述虚拟交换机连接M个虚拟机和N个网络接口卡，M、N为大于或者等于2的整数，其特征在于，所述装置包括：第一接收单元，确定单元和卸载单元。
建立单元，用于建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口。卸载单元，用于通过所述第一端口将精确流表卸载至所述N个网络接口卡。
在一种可能的实现方式中，所述装置还包括：第一接收单元，用于接收目标网络接口卡发送的消息，所述消息携带所述目标网络接口卡接收到的报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，所述消息是所述目标网络接口卡在接收到所述报文后查询到内部不存在与所述报文对应的卸载流表后发送的，所述目标网络接口卡是所述N个网络接口卡中的其中一个；确定单元，用于基于所述报文和所述虚拟功能的标识，确定所述的精确流表，所述精确流表用于指示对所述报文的处理。
在一种可能的实现方式中，所述装置还包括：第二接收单元，还用于通过第二端口接收目标虚拟机发送的所述报文，所述目标虚拟机是所述M个虚拟机中的任意一个，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；所述确定单元，还用于从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；发送单元，用于将所述报文发送至所述目标虚拟功能，以使所述目标虚拟功能对应的所述目标网络接口卡根据所述报文查询是否存在与所述报文对应的卸载流表。
在一种可能的实现方式中，所述卸载单元还用于确定所述精确流表满足卸载条件，其中，在用于确定所述精确流表满足卸载条件时，所述卸载单元具体用于：根据所述精确流表对应的报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或根据所述精确流表对应的报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应， N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。
在一种可能的实现方式中，所述装置还包括：第一更新单元，用于在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
在一种可能的实现方式中，在所述装置还包括：第二更新单元，用于在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
在一种可能的实现方式中，所述装置还包括：第三更新单元，用于在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
在一种可能的实现方式中，所述第三更新单元，还用于当所述第二网络接口卡状态正常时，将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
在一种可能的实现方式中，所述第二接收单元还用于通过所述第二端口接收所述目标虚拟机发送的数据流，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表，所述数据流被分为K个队列；所述发送单元，还用于将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，其中，K为N的整数倍，所述目标虚拟机的虚拟网卡被配置为K个队列，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
第四方面，本发明实施例提供了一种物理机，所述物理机包含主机和N个网络接口卡，所述主机上运行有M个虚拟机和上述第一方面任一可能的实现方式所提供的虚拟交换机，所述N个网络接口卡通过主机接口与主机相连，所述N个网络接口卡通过网络接口与外部 网络相连，M、N为大于或者等于2的整数，所述M个虚拟机包括目标虚拟机，所述N个网络接口卡包括目标网络接口卡，其中：
所述虚拟交换机，用于建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为所述第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；
所述目标网络接口卡，用于接收报文，所述报文是与所述物理机连接的物理交换机发送的或是目标虚拟机发送的报文，所述目标虚拟机是所述M个虚拟机中任意一个，所述目标网络接口卡是所述N个网络接口卡中的其中一个；
所述虚拟交换机，还用于在所述目标网络接口卡查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表的情况下，通过所述第一端口将所述报文对应的精确流表卸载至所述N个网络接口卡。
在一种可能的实现方式中，所述目标网络接口卡，用于在查询到内部不存在与所述报文对应的卸载流表时，向所述虚拟交换机发送消息，所述消息携带所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识。所述虚拟交换机还用于基于所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，确定与所述报文对应的精确流表。
在一种可能的实现方式中，所述目标网络接口卡，还用于基于所述卸载的精确流表对所述报文进行处理。
在一种可能的实现方式中，在所述目标网络接口卡，还用于查询到内部存在与所述报文对应的卸载流表时，基于所述卸载流表对所述报文进行处理。
在一种可能的实现方式中，所述报文是所述目标虚拟机发送的，所述目标虚拟机包括虚拟网卡，所述虚拟网卡的工作模式包括软直通模式和硬直通模式；所述目标虚拟机，还用于在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，向所述虚拟交换机发送所述报文；所述虚拟交换机，还用于通过第二端口接收所述目标虚拟机发送的所述报文，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；所述虚拟交换机，还用于从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；所述虚拟交换机，还用于将所述报文发送至所述目标虚拟功能；
所述目标虚拟机，还用于在所述目标虚拟机的虚拟网卡的工作模式被配置为硬直通模式时，从所述N个网络接口卡对应的N个虚拟功能中确定所述目标虚拟功能；所述目标虚拟机，还用于通过第三端口向所述目标虚拟功能发送所述报文，其中，所述第三端口为所述N个虚拟功能在所述目标虚拟机内聚合形成的逻辑端口。
在一种可能的实现方式中，所述虚拟交换机还用于确定所述报文对应的精确流表满足卸载条件，其中在用于确定所述报文对应的精确流表满足卸载条件时，所述虚拟交换机具体用于根据所述报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或根据所述报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应， N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。
在一种可能的实现方式中，所述虚拟交换机还用于在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
在一种可能的实现方式中，所述虚拟交换机还用于在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
在一种可能的实现方式中，所述虚拟交换机还用于在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；向所述第二网络接口卡发送标记指令，并解除解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
在一种可能的实现方式中，所述虚拟交换机还用于，当所述第二网络接口卡状态正常时，所述虚拟交换机将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
在一种可能的实现方式中，在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，所述目标虚拟机，还用于配置虚拟网卡的队列数为K并将待发送的数据流分为K个队列，其中，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表；所述虚拟交换机，还用于通过所述第二端口接收所述目标虚拟机发送的所述数据流；所述虚拟交换机，还用于将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，K为N的整数倍，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
第五方面，本发明实施例提供一种物理机，该物理机中包括处理器，处理器被配置为支持该虚拟交换机实现第一方面或第二方面提供的流表处理方法中相应的功能。该物理机还可以包括存储器，存储器用于与处理器耦合，其保存该物理机必要的程序指令和数据。该物理机还可以包括通信接口，用于该物理机与其它设备或通信网络通信。
第六方面，本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持物理机实 现上述第一方面或第二方面中所涉及的功能，例如，生成或处理上述流表处理方法中所涉及的信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其它分立器件。
第七方面，本发明实施例提供了一种计算机存储介质，用于储存为上述第一方面或第二方面提供的物理机中的处理器中所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第八方面，本发明实施例提供了一种计算机程序，其特征在于，所述计算机程序包括指令，当所述计算机程序被计算机执行时，使得所述计算机执行上述第一方面或第二方面提供的物理机中的处理器所执行的流程。
附图说明
为了更清楚地说明本发明实施例或背景技术中的技术方案，下面将对本发明实施例或背景技术中所需要使用的附图进行说明。
图1是本发明实施例提供的一种虚拟交换机原理示意图。
图2是本发明实施例提供的一种开放流虚拟交换机卸载方案的系统架构图。
图3是本发明实施例提供的一种弹性虚拟交换机的系统架构图。
图4是本发明实施例提供的一种单根输入输出虚拟化绑定方案的系统架构图。
图5是本发明实施例提供的一种服务器架构示意图。
图6是本发明实施例提供的一种物理机结构示意图。
图7是本发明实施例提供的一种提供的一种流表处理方法的流程示意图。
图8是本发明实施例提供的一种流表处理方法的流程示意图。
图9是本发明实施例提供的一种流表处理方法的流程示意图。
图10是本发明实施例提供的一种流表处理方法的流程示意图。
图11是本发明实施例提供的一种流表处理方法的流程示意图。
图12是本发明实施例提供的一种流表处理装置的结构示意图。
图13是本发明实施例提供的又一种物理机的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例进行描述。
本申请的说明书和权利要求书及所述附图中的术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在2个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
首先，分析并提出本申请所具体要解决的技术问题。首先，需要先对本申请实施例所解决的技术问题对应的实际应用场景进行阐述和分析。
本申请涉及计算机的云计算网络虚拟化技术领域，网络虚拟化中最重要的部件就是虚拟交换机(Virtual Switch，vSw)，虚拟交换机运行在主机Host上，为虚拟机或容器提供网络通信流量交换。图1是虚拟交换机的原理示意图，如图1所示，虚拟交换机从架构上由管控平面和转发平面组成，其中转发平面包含虚拟输入/输出(Input/Output，I/O)，交换平面以及物理I/O三部分。具体地，虚拟交换机由Neutron或敏捷控制器(Agile Controller，AC)等配置管理，下发虚拟网卡、物理网络接口卡等对象创建和配置。虚拟机或容器通过前端虚拟网卡驱动与虚拟交换机的虚拟IO后端配合，完成报文收发。
虚拟交换机的发展逐步经历了内核态软交换、用户态软交换和硬件卸载交换三个阶段。在内核态软交换和用户态软交换阶段，数据流通过网络接口卡进入虚拟交换机，当一个新数据流的报文在首次流入虚拟交换机时，虚拟交换机会分析该数据流的报文，并确定如何处理该报文，最后将对该报文的处理过程记录下来并生成相关的精确流表。当该数据流的后续报文流入虚拟交换机时，虚拟交换机会根据报文的信息命中对应的精确流表，继而直接执行流精确流表中指示的行为，以完成对报文的处理，比如对报文封装或解封装后通过网络接口卡转发给其它设备。但是，流表的匹配及流表中行为执行过程直接影响到虚拟交换机的报文处理性能。为了提高报文处理效率，在硬件卸载交换阶段，虚拟交换机将精确流表卸载到网络接口卡上。当报文经过网络接口卡时，网络接口卡直接根据报文的信息命中对应的卸载流表，进而根据命中的卸载流表项对报文进行相应处理，不再将报文转发至虚拟交换机，从而可以提高报文处理效率。硬件卸载交换技术逐渐得到主流厂商的使用，该方法有很多优点，例如性能较高的同时又保证了丰富的功能。但是硬件卸载交换技术由于软硬协同机制复杂存在跨网络接口卡可靠性问题，只能实现单一网络接口卡内不同链路的可靠性，如果该单一的网络接口卡故障，那么整个系统就故障了，因此存在单点故障的风险。
目前市面上主要存在以下三种基于硬件卸载交换技术的方案，以下进行分别介绍。
现有技术一
图2是开放流虚拟交换机(Openflow Virtual Switch，OVS)卸载方案的系统架构图，如图2所述，该系统架构包括主机host和智能网络接口卡(SmartNetwork Interface Card，Smart NIC)。虚拟机和OVS运行在主机中。其中，OVS包括用户空间和内核空间。用户空 间包括OVS控制面，OVS控制面进一步包括Ovsdb-sever进程和Ovsdb-vswitch进程。内核空间包括OVS内核数据路径(Datapath，DP)转发库。Smart NIC这一硬件模块中也包括一嵌入式交换机(Embedded Virtual Switch，eVS)，该嵌入式虚拟交换机内部包括虚拟交换机卸载(vSwitch offload)模块。
OVS控制面负责数据库管理，慢路径规则的学习，openflow慢路径的流表(flow table)规则匹配，以及精确流表的生成与管理。vSwitch offload或OVS kernel DP中查找卸载流表或精确流表未命中时，需要OVS控制面协助处理。
OVS Kernel DP负责在内核空间完成精确流表的查找与转发，当开启硬件卸载时，配合OVS控制面通过Linux内核提供的TC flower工具完成精确流表的生成和卸载。vSwitch offload模块运行在网络接口卡内部，为虚拟机提供快路径转发。具体地，OVS初始化的时候，会向嵌入式交换机下发一条默认的规则。对于一个数据流，第一个报文到达嵌入式交换机时，如果该报文匹配不了任何其它规则，则会被默认规则匹配。这条默认规则对应的行为action就是将报文送到嵌入式交换机的管理主机，即位于内核空间的OVS内核路径转发库。若这个报文是数据流的首包的话，OVS内核路径转发库没有转发信息，并不知道怎么完成转发。接下来OVS内核路径转发库会查询位于用户空间的ovs-vswitchd进程。ovs-vswitchd进程因为存储OpenFlow规则，ovs-vswitchd可以根据OpenFlow规则完成行为匹配操作，也就是从一堆OpenFlow规则里面匹配报文对应的规则，根据这些规则里的行为实现转发。同时，ovs-vswitchd进程会判断当前数据流对应的规则能否卸载(offload)到网络接口卡。如果可以的话，ovs-vswitchd进程会调用通过TC接口将OpenFlow规则卸载至硬件。这样，同一个数据流的后继报文，可以直接在网络接口卡的嵌入式虚拟交换机中完成转发，不需要走到主机操作系统来。
如图2所示的开放流虚拟交换机卸载方案虽然能够有效实现硬件卸载转发的功能，解决OVS内核路径转发库在操作系统内核空间实现转发所带来的针对网络性能(吞吐量，时延，包转发性能(Packet Per Second，PPS))的影响。但是现有技术中卸载网络接口卡只能使用一个，只能提供链路级的可靠性，无法提供多网络接口卡的可靠性保障。如果网络接口卡故障，那么整个系统就故障了，存在单点故障的风险。
现有技术二
图3是一种弹性虚拟交换机(Elastic Virtual Switch，eVS)的系统架构图。eVS是基于开源OVS扩展改造的虚拟交换机。如图3所示，该系统架构包括主机host和Smart NIC。虚拟机和弹性虚拟交换机运行在主机中。eVS包含eVS控制面、核心转发模块和Vhostdp软直通模块，核心转发模块包括软件慢路径转发模块和智能卸载引擎模块。Smart NIC包括数据路径模块。
eVS控制面负责数据库管理和openflow慢路径的流表规则匹配，以及精确流表的生成与管理，还提供了安全规则检查等功能。软件慢路径转发模块集成转发引擎，和硬件卸载引擎模块相互配合，负责将转发路径上的多次表查找和执行动作结果合并归一，形成单次匹配和单次执行的硬件卸载流表，使得更容易在硬件智能卸载网络接口卡内部执行。在虚拟机的虚拟网卡配置为半虚拟化virtio(或软直通模式)时，Vhostdp软直通模块负责在网络接口卡和虚拟网卡之间搬运IO报文。智能网路接口卡中的数据路径模块运行在硬件网络 接口卡内部，利用弹性虚拟交换机下发的卸载流表为虚拟机提供快路径转发。
如图3所示的弹性虚拟交换机虽然能够有效实现硬件卸载转发的功能，解决性能问题，然而仍然存在硬件卸载网络接口卡只能使用一个，Bond技术只能提供链路级的可靠性，无法提供多网络接口卡的可靠性保障。
现有技术三
图4是单根输入输出虚拟化(single rootiinput/output virtualization，SR-I/OV)绑定bond方案的系统架构图。该系统是在SR-I/OV虚拟化的基础上引入linux bond组件，通过PF的LACP bond来控制虚拟机内虚拟功能的bond的工作方式。
两个网络接口卡均开启SR-I/OV功能。两个网络接口卡各贡献一个虚拟功能给两个虚拟机使用。两个网络接口卡的物理功能PF在Host组LACP模式的Bond，同时TOR侧开启LACP聚合协商功能。在虚拟机内两个网络接口卡贡献的两个虚拟功能组负载均衡模式(非LACP)的Bond，按照配置的哈希hash算法选择某个虚拟功能收发流量。当主机的LACP bond聚合状态变更时，通过硬件网络接口卡的链路控制机制知会到虚拟机内的功能和Bond，触发链路切换。
如图4所示的SR-I/OV bond方案能够解决跨网络接口卡可靠性问题，也能提升高性能，然而SR-I/OV方式下网络接口卡转发只能提供简单的二层mac+vlan转发，由于没有虚拟交换机对报文执行软件慢路径规则的学习，不支持虚拟交换机的硬件卸载，因此无法支撑云计算平台丰富的业务功能诉求。
基于上述提出的技术问题以及本申请中对应的应用场景，也为了便于理解本发明实施例，下面先对本发明实施例所基于的其中一种服务器架构进行描述。图5是本发明实施例提供的一种服务器架构示意图，如图5所示，该服务器架构中包含了至少一个物理机(或称为计算机设备、物理主机或物理计算机)10和物理交换机20。多个物理机10通过物理交换机20相连进而连接到外部网络，实现和外部通信。
其中，每一个物理机10都有完整的软件环境和硬件环境，物理机的硬件环境至少包括主机和网络接口卡(或称网卡、物理网卡或物理网络接口卡)(network interface card，NIC)105。其中，物理机中除网络接口卡之外的部分称之为主机。可选地，主机包括CPU103和内存104。物理机的软件环境至少包括虚拟交换机102以及至少一台虚拟机101，即虚拟交换机102以及至少一台虚拟机101运行在物理机10的主机中。可选的，物理机的软件环境还包括虚拟机监视器(virtual machine monitor，VMM)(图未示)，虚拟机监视器又称为虚拟机管理器(virtual machine manager)或管理程序(hypervisor)，用于管理上述一个或多台虚拟机101。
通过虚拟化技术，可以在一台物理机上模拟出一台或多台虚拟机。虚拟机可以像物理机一样工作。例如，用户可以在虚拟机上安装操作系统和应用程序；又如，用户可以通过虚拟机访问网络资源。对于用户而言，虚拟机可以看成是运行在物理机上的应用程序，但对于运行在虚拟机中的应用程序而言，虚拟机就像真正的物理机一样为该应用程序提供工作环境。虚拟机包括用户态和内核态，是操作系统的两种运行级别。用户在用户态上发出各种指令，用户发出的指令从虚拟机的用户态生成下发到虚拟机的内核态。物理机模拟出 的一个或多个虚拟机一方面需要共享网络接口卡与外界资源通信，另一方面，虚拟机之间也需要通信，虚拟交换机就可以实现同一主机内不同虚拟机之间的相互通信。
本申请实施例中的网络接口卡为支持单根输入输出虚拟化(Single Root input/Output Virtualization，SR-I/OV)功能的网络接口卡。SR-I/OV技术允许在多个虚拟机之间高效共享外设部件互连表示(peripheral component interconnect express，PCIe)设备(如网络接口卡)。SR-I/OV引入了物理功能(physical function，PF)和虚拟功能(virtual function，VF)的概念，以支持网络接口卡的虚拟化。PF是网络接口卡所支持的一项外设部件互连(peripheral component interconnect，PCI)功能，PF可以扩展出若干个虚拟功能。虚拟功能是支持SR-I/OV的网络接口卡所虚拟出的一个“网卡”或者说虚拟出来的一个实例。虚拟功能会以一个独立网络接口卡的形式呈现出来，每个虚拟功能都有自己独享的PCI配置区域，网络接口卡中的每个虚拟功能配置有进行数据传输的带宽资源，每个虚拟功能会经由虚拟机监视器分配给主机设备上运行的虚拟机使用。网络接口卡内部也提供了虚拟交换机功能，并能通过物理功能/虚拟功能提供了带宽限制功能。用户(或管理员)可以根据该带宽限制功能为每个虚拟功能分配带宽。一个虚拟功能对应一个虚拟机的一个虚拟网络接口卡(virtual network interface card，vNIC，简称虚拟网卡)。在网络接口卡启用SR-I/OV之后，网络接口卡将通过虚拟功能与虚拟机的虚拟功能驱动VF driver进行数据交互。通过SR-I/OV技术，将单一的网络接口卡虚拟成多个虚拟功能接口，每个虚拟功能接口都有单独的虚拟PCIe通道，这些虚拟的PCIe通道共用网络接口卡的PCIe通道。每个虚拟机可占用一个或多个虚拟功能接口，这样虚拟机就可以直接访问自己的虚拟功能接口，而不需要虚拟机监视器的协调干预，从而大幅提升网络吞吐性能。本申请实施例中，示例性的采用了SR-I/OV的网络接口卡与虚拟机直连的技术，在实际使用中也可以采用其它支持网络接口卡和虚拟机直连的技术。
本申请实施例中的网络接口卡不局限于商业网络接口卡芯片，即本申请实施例中的网络接口卡可以包括NP(Network Processor，网络处理器)、FPGA(Field-Programmable Gate Array，现场可编程门阵列)等可编程器件及商业网络接口卡芯片。具体地，所有能够实现网络接口卡功能的芯片或者设备均可以作为本申请实施例中的网络接口卡，均在本申请的保护范围之内。
本申请实施例中，虚拟机101与网络接口卡105连接或者虚拟机101通过虚拟交换机与网络接口卡105连接，继而和外部通信。其中，当虚拟机101的虚拟网卡被配置为硬直通模式时，虚拟机101与网络接口卡105直接连接；当虚拟机101的虚拟网卡被配置为软直通模式时，虚拟机101通过虚拟交换机与网络接口卡105连接。其中，本申请实施例中任意一个物理机10都可以作为本申请中的物理机实施本申请实施例所提供的流表处理方法。本申请实施例中，所有的虚拟机都可以与网络接口卡和虚拟交换机连接，实际上也可以只有部分虚拟机(虚拟网卡的工作模式配置为硬直通)与网络接口卡相连，其它部分虚拟机(虚拟网卡的工作模式配置为软直通)与虚拟交换机连接，具体虚拟机的配置方式可以按场景按需配置，并不限定于必须全部都与网络接口卡连接。可以理解的是，图5中的服务器架构只是本发明实施例中的一种示例性的实施方式，本发明实施例中的服务器架构但不仅限于以上服务器架构。
基于上述服务器架构，本发明实施例提供了一种应用于上述服务器架构中的物理机10。如图6所示，图6是本发明实施例提供的一种物理机的结构示意图，物理机的硬件环境包括主机，第一网络接口卡105-A和第二网络接口卡105-B，在主机中运行有第一虚拟机101-1，第二虚拟机101-2和虚拟交换机102。需要说明的是，本发明实施例中的第一网络接口卡105-A和第二网络接口卡105-B的实质相同，均可以为图5对应的实施例中提供的网络接口卡105，为了便于描述，将物理机包括的两个网络接口卡分别命名为第一网络接口卡和第二网络接口卡。同理，本发明实施例中的第一虚拟机101-1和第二虚拟机101-2均可以为图5对应的实施例中提供的虚拟机101，为了便于描述，将虚拟机所包括的虚拟网卡中工作模式被配置为硬直通模式的虚拟机称为第一虚拟机101-1，将虚拟机所包括的虚拟网卡中工作模式被配置为软直通模式的虚拟机称为第二虚拟机101-2。
虚拟网卡的工作模式被配置为硬直通模式的第一虚拟机101-1包括虚拟机绑定(VM Bond)模块1001和设备对象。其中，针对每个网络接口卡拓展的虚拟功能，虚拟机会产生不同的设备对象，这些不同的设备对象由虚拟机的虚拟功能驱动进行统一管理。虚拟功能驱动，用于在硬直通场景下，通过虚拟功能驱动实现虚拟机与不同网络接口卡对应的不同的虚拟功能之间的数据传输。其中，虚拟功能驱动只加载一次。虚拟网卡的工作模式被配置为软直通模式的第二虚拟机101-2包括半虚拟化驱动Vitio-net，第二虚拟机通过半虚拟化驱动与虚拟交换机进行通信。
VM Bond模块1001，本质上属于虚拟的IO接口，其用于，当第一虚拟机101-1的虚拟网卡配置成虚拟功能硬直通模式时，在虚拟机内将两个网络接口卡各分配给虚拟机的一个虚拟功能绑定以形成网络接口，从而在虚拟机发送报文时，通过VM Bond模块1001基于哈希算法选择其中一个虚拟功能，进而通过该虚拟功能将报文发送至扩展出该虚拟功能的网络接口卡105。具体地，在硬直通场景下，从虚拟交换机侧看，虚拟机侧仅提供一个逻辑口，即VM Bond模块1001，报文从虚拟机发出时可以包括多条流，虚拟机基于报文的五元组(即源IP地址(SIP)、源端口号(SPORT)、目的IP地址(DIP)、目的端口号(DPORT)、传输层协议号(IP type))确定一哈希值，并针对第一网络接口卡105-A和第二网络接口卡105-B进行哈希负荷分担，进而确定第一网络接口卡(和或第二网络接口卡)以及第一网络接口卡分配给第一虚拟机101-1的虚拟功能vfA.1(和或第二网络接口卡分配给第一虚拟机101-1的虚拟功能vfB.1)。
虚拟交换机102包括：核心转发模块1021，虚拟交换机绑定(vSW-Bond)模块1022和Vhostdp软直通模块1023，其中，核心转发模块1021进一步包括软件慢路径转发模块1024和多网络接口卡智能卸载引擎模块1025。上述各个软件模块的功能描述如下。
软件慢路径转发模块1024负责虚拟交换机102的流规则管理和报文慢路径的匹配，提供隧道管理、安全规则管理等业务功能。
多网络接口卡智能卸载引擎模块1025负责收集慢路径转发中报文匹配的多个精确流表以及对应的报文编辑结果，并将这些信息合并归一处理，结合报文对应流速率和状态进行策略管理。最后生成卸载流表，将卸载流表分别下发给第一网络接口卡105-A和第二网络接口卡105-B分别对应的第一硬件数据路径(Datapath)模块1051-A和第二硬件数据路 径(Datapath)模块1051-B。
vSW-Bond模块1022，本质上属于虚拟的IO接口，其用于，在每个网络接口卡的多条链路聚合成绑定(bond)后，vSW-Bond模块1022将两个网络接口卡的两个绑定(即Hwbond–A和Hwbond–B)聚合，以形成虚拟交换机的上联(Uplink)端口。vSW-Bond模块1022监控到Hwbond–A和/或Hwbond–B的状态变更时会同步知会到Vhostdp软直通模块1023中的VF bond模块1026和第一虚拟机101-1中的VM Bond模块1001。
Vhostdp软直通模块1023进一步包括VF bond模块1026。当第二虚拟机101的虚拟网卡配置成半虚拟化Virtio(即软直通模式)时，虚拟交换机同时从两个网络接口卡上为其各分配一个虚拟功能与虚拟网卡对应。VF bond模块1026，本质上属于虚拟的IO接口，其用于，当第二虚拟机101的虚拟网卡配置成软直通模式时，在Vhostdp软直通模块1023内将两个网络接口卡各分配给虚拟机的一个虚拟功能绑定，Virtio虚拟网卡的后端与这两个虚拟功能的绑定构成端对端(peer to peer)的关系。报文搬运通过Vhostdp软直通模块1023完成。在一种可选的实施方式中，物理机还利用多队列机制，将虚拟机的虚拟网卡配置队列数为K(K为偶数)时，第一网络接口卡和第二网络接口卡对应的每个虚拟功能负责其中K/2个队列的流量收发，虚拟网卡的队列和虚拟功能队列建立了一一对应关系，如此，软直通模块1023通过零拷贝的方式收发报文。
网络接口卡包括硬件数据路径Datapath模块，Bond和至少一个虚拟功能。具体地，如图6所示，第一网络接口卡105-A包括第一硬件数据路径Datapath模块1051-A，HwBond-A，虚拟功能vfA.1和虚拟功能vfA.2，第二网络接口卡105-B包括第二硬件数据路径Datapath模块1051-B，HwBond-B，虚拟功能vfB.1和虚拟功能vfB.2。
上述各个软件模块的功能描述如下。
第一硬件数据路径Datapath模块1051-A或第二硬件数据路径Datapath模块1051-B，具体用于接收从多网络接口卡智能卸载引擎模块1025下发的卸载流表。例如，第一虚拟机101-1或第一虚拟机101-2发送的报文到达第一网络接口卡105-A和第二网络接口卡105-B中的至少一个时，第一网络接口卡105-A(或第二网络接口卡105-B)通过其内部的第一硬件Datapath模块1051-A(或第二硬件Datapath模块1051-B)查询与报文匹配的卸载流表，如果存在与所述报文匹配的卸载流表，则根据卸载流表实现报文转发；若不存在与所述报文匹配的卸载流表，通过上行调用upcall线程上送到核心慢路径转发模块1024和多网络接口卡智能卸载引擎模块1025进行匹配和学习，以生成报文对应的精确流表，多网络接口卡智能卸载引擎模块1025最终将生成的精确流表卸载至第一硬件Datapath模块1051-A和第二硬件Datapath模块1051-B。
Bond(如图6所示的Hwbond–A或Hwbond–B)为每个网络接口卡内部的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口。
虚拟功能是支持SR-I/OV的网络接口卡所虚拟出的“网卡”或者说虚拟出来的实例，在网络接口卡启用SR-I/OV之后，网络接口卡将通过虚拟功能VF与虚拟机的VF driver进行数据交互。
可以理解的是，图6中的物理机的结构只是本发明实施例中的一种示例性的实施方式，本发明实施例中的物理机的结构包括但不仅限于以上结构。
需要说明的是，图6所示的各个模块可以是运行于物理机中的软件模块或程序，该模块或程序被处理器执行时实现相应的功能。可以理解的是，本申请实施例提供的各个模块还可以以硬件的形式实现，比如实现为处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合，本申请对此不做限定。
本申请实施例中，存在三种虚拟IO接口，即VM Bond模块1001，VF bond模块1026以及vSW-Bond模块1022。在虚拟机的虚拟网卡配置为硬直通模式时，报文的慢路径转发基于VM Bond模块1001以及vSW-Bond模块1022完成，报文的快路径转发基于VM Bond模块1001完成。在虚拟机的虚拟网卡配置为软直通模式时，报文的慢路径转发基于VF bond模块1026以及vSW-Bond模块1022完成，报文的快路径转发基于VF bond模块1026完成。因此，上述三种虚拟IO接口可以实现解除硬件规格限制，按场景按需使用。同时，本申请实施例提供的物理机一方面支持故障检测与自愈，检测到虚拟网卡硬直通故障时自动切换到软直通继续提供服务，另一方面支持多网络接口卡同时卸载，例如采用主网络接口卡和备用网络接口卡方式，主网络接口卡故障时，虚拟交换机自动切换到备用网络接口卡上，自动完成卸载数据同步。
基于图5提供的服务器架构和图6所提供的物理机，结合本申请中提供的流表处理方法，对本申请中提出的技术问题进行具体分析和解决。
参见图7，图7是本发明实施例提供的一种流表处理方法的流程示意图，该方法可应用于上述图5中所述的服务器架构中任意一个物理机10中，该方法可应用于上述图6中所述的物理机10中，其中物理机10可以用于支持并执行图7中所示的方法流程步骤S701和步骤S702。所述物理机包含主机和N个网络接口卡，所述主机上运行有虚拟交换机和M个虚拟机，所述N个网络接口卡通过主机接口与主机相连，所述N个网络接口卡通过网络接口与外部网络相连，M、N为大于或者等于2的整数。下面将结合附图5从虚拟机，虚拟交换机以及网络接口卡的交互侧进行描述。
该方法可以包括以下步骤S701至步骤S703，可选地，还可以包括步骤S704至步骤707，可选地，还可以包括步骤S708。步骤S702可选地可以包括S702a-S702c，还可以包括S702d-S702e。
S701：虚拟交换机建立所述N个逻辑端口的N个端口标识与所述目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为所述第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口。
本发明实施例中，所述第一端口为所述N个网络接口卡对应的N个逻辑端口聚合形成的逻辑端口，所述N个逻辑端口被设置为对应目标端口标识。具体地，首先，每个网络接口卡内部的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口，以形成第一级绑定；其次，虚拟交换机建立所述N个逻辑端口的N个端口标识与所述目标端口标识之间的映射关系，从而将N个网络接口卡对应的N个逻辑端口设置为对应目标端口标识，以形成第二级负载均衡绑定。上述两级绑定实现了精确流表的多网络接口卡卸载，与虚拟交换机 连接的任意一个网络接口卡故障时，虚拟交换机可以自动切换至其它可用的网络接口卡，从而达到跨网络接口卡可靠性保证的效果。其中，所述N个逻辑端口被设置为对应目标端口标识用以实现N个网络接口卡对应的N个逻辑端口的聚合。此处所述N个逻辑端口被设置为对应目标端口标识的原因是：若不同的网络接口卡对应不同的逻辑端口标识，不同的逻辑端口标识意味着多个网络接口卡对应多个不同的逻辑链路，那么此时在物理交换机和虚拟交换机之间可能会基于多个网络接口卡对应的多个不同的逻辑链路形成数据回环。举例来说，多个网络接口卡中的第一网络接口卡收到一地址解析协议(Address Resolution Protocol,ARP)报文，该报文可以是虚拟机发送至第一网络接口卡的也可以是其它物理机通过物理交换机发送至该第一网络接口卡的，由于此类报文对应的精确流表无法卸载至网络接口卡，必须基于虚拟交换机进行报文广播，因此第一网络接口卡会将该ARP报文上送至虚拟交换机，以使虚拟交换机针对该ARP报文进行广播。其中，假如该ARP报文是其它物理机经由物理交换机发送至第一网络接口卡的，那么第一网络接口卡在将该ARP报文经由第一网络接口卡对应的逻辑链路上送至虚拟交换机后，由于第一网络接口和多个网络接口卡中的第二网络接口卡对应不同逻辑链路，那么虚拟交换机会将该ARP报文经过第二网络卡对应的逻辑链路再次广播至物理交换机，至此该ARP报文在虚拟交换机和物理交换机之间产生数据回环。假如该报文是其他虚拟机发送至第一网络接口卡的，那么第一网络接口卡在将该ARP报文经由第一网络接口卡对应的逻辑链路上送至虚拟交换机后，虚拟交换机会将该报文经过第二网络卡对应的逻辑链路广播至物理交换机，物理交换机接收到该ARP报文后会通过第一网络卡对应的逻辑链路再次广播至虚拟交换机，至此该ARP报文也会在虚拟交换机和物理交换机之间产生数据回环。物理交换机和虚拟交换机之间数据回环会影响系统的性能甚至导致报文处理异常。
步骤S702，目标虚拟机向目标网络接口卡发送报文。
其中目标网络接口接收的报文可以是目标虚拟机发送的，也可以是其他物理机经由物理交换机发送的。本申请实施例以目标虚拟机向目标网络接口卡发送报文为例进行阐述。
所述目标虚拟机是所述M个虚拟机中任意一个，所述目标网络接口卡是所述N个网络接口卡中的其中一个。具体地，所述目标虚拟机包括虚拟网卡，虚拟网卡的工作模式包括软直通模式和硬直通模式。当目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，目标虚拟机将报文发送至虚拟交换机的软直通模块，软直通模块通过内部的VF bond模块基于哈希算法选择一虚拟功能，进而确定扩展出该虚拟功能的目标网络接口卡，将报文发送至目标网络接口卡。当目标虚拟机的虚拟网卡的工作模式被配置为硬直通模式时，目标虚拟机将报文通过内部的VM bond模块基于哈希算法选择一虚拟功能，进而确定扩展出该虚拟功能的目标网络接口卡，并将报文通过VM bond模块发送至目标网络接口卡。其中，在VF bond模块内，N个网络接口卡对应的N个虚拟功能发生聚合，在VM bond模块内，N个网络接口卡对应的N个虚拟功能发生聚合。
由于物理机中包括的N个网络接口卡中存储的卸载流表完全相同，因此，无论软直通模块通过内部的VF bond模块或者目标虚拟机通过内部的VM bond模块选择哪一个网络接口卡的虚拟功能，该虚拟功能均可以实现报文的转发。另外，通过物理交换机发送至主机和虚拟机的方向，物理交换机也可以基于哈希算法选择一网络接口卡，进而由选择的网络 接口卡实现数据转发。
步骤S703，在所述目标网络接口卡查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表的情况下，所述虚拟交换机通过第一端口将所述精确流表卸载至所述N个网络接口卡。
在本发明实施例中，通过上述两级绑定形成的第一端口一方面可以避免N个逻辑端口分别对应不同的端口标识所可能导致的物理交换机和虚拟交换机之间数据回环，进而影响系统的性能甚至导致报文处理异常的问题；另一方面，实现了精确流表的多网络接口卡卸载，即虚拟交换机可以通过第一端口将所述精确流表卸载至所述所有的网络接口卡，从而解决了在将精确流表卸载到单一网络接口卡或基于单一网络接口卡进行报文处理的过程中，该单一网络接口卡故障而导致业务终止的问题，虚拟交换机将精确流表卸载至与主机连接的所有网络接口卡，使得在任一网络接口卡故障时，虚拟交换机可以切换至其它网络接口卡，从而保证报文处理业务的可靠性。
在一种可能的实现方式中，所述虚拟交换机在确定所述报文对应的精确流表满足卸载条件的情况下，通过第一端口将所述精确流表卸载至所述N个网络接口卡之前，所述方法还可以包括以下步骤中步骤S704至S707。
步骤S704，所述目标网络接口卡查询内部是否存在与所述报文对应的卸载流表。
具体地，报文由匹配信息和载荷(payload)构成。其中，匹配信息用于与流表的匹配域进行匹配。流表(flow table)是描述何种数据流的报文要经过何种处理的表，用于在软件定义网路(Software Defined Network，SDN)中控制数据流，也可以称为SDN流表，具体可以采用符合OpenFlow协议的流表或符合其它协议的流表。流表按照存储位置不同具体分为卸载流表(也称为硬件流表)和精确流表(也称为软件流表)。存储在网络接口卡中的流表为卸载流表。由虚拟交换机基于报文以及虚拟功能的标识进行慢路径转发学习生成的流表为精确流表(存储在虚拟交换机中)。网络接口卡中存储的卸载流表与位于虚拟交换机中的精确流表保持同步。流表至少包括匹配域和执行域，匹配域用于与报文进行匹配，执行域用于指示匹配上流表的报文应该执行的动作。执行域包括了报文的动作标识，例如转发、丢弃、上送SDN控制器等。其中，报文的匹配信息用于指示报文所属的数据流的特征信息，匹配信息具体可以是报文的报头中携带的某几个字段，这些字段是同属于一条数据流中的所有报文都携带的，即同属于同一数据流的报文具有相同的匹配信息。在一个实施例中，报文的匹配信息可以是源IP地址(SIP)、源端口号(SPORT)、目的IP地址(DIP)、目的端口号(DPORT)、传输层协议号(IP type)和子网标识符，通过这些信息可以唯一确定一条数据流(也可称为“连接”)，本申请的实施例不限于此，其它可以唯一确定一条数据流的信息也可以作为报文的匹配信息。其中，数据流(data flow)指示携带相同匹配信息的一系列报文。具体地，同一数据流中的报文的匹配信息，均可以匹配上该数据流对应的精确流表或卸载流表的匹配域。
所述目标网络接口卡查询内部是否存在与所述报文对应的卸载流表具体可以为所述目标网络接口卡基于报文的匹配信息查询内部是否存在与报文的匹配信息匹配的匹配域，进而基于匹配域确定对应的卸载流表。
步骤S705，所述目标网络接口卡在查询到内部不存在与所述报文对应的卸载流表时， 向所述虚拟交换机发送消息。
其中，所述消息携带所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识。具体地，所述目标网络接口卡在查询到内部不存在与所述报文对应的卸载流表时，无法对所述报文进行处理，因此需要将报文和目标网络接口卡的虚拟功能的标识通过upcall线程上送至虚拟交换机，以使虚拟交换机基于报文和目标网络接口卡的虚拟功能的标识确定与所述报文对应的精确流表。其中，所述目标网络接口卡的虚拟功能的标识不仅用于指示报文是从哪一个网络接口卡上送的，而且由于网络接口卡的虚拟功能与虚拟机对应，因此，所述目标网络接口卡的虚拟功能的标识还可以用于指示该报文是哪一个虚拟机发送的。
可选地，如果在目标网络接口卡查询到内部存在与所述报文对应的卸载流表时，则目标网络接口卡可以直接将报文转发至其它虚拟机或者通过网络接口卡转发至外部网络。
步骤S706，所述虚拟交换机基于所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，确定与所述报文对应的精确流表。
具体地，在目标网络接口卡向所述虚拟交换机发送消息后，虚拟交换机通过虚拟网卡的代理端口接收该消息。所述虚拟交换机通过核心慢路径转发模块基于所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识进行报文慢路径的匹配，执行安全检查、状态更新和墓地位置查找等逻辑，最终确定与所述报文对应的精确流表。具体地，虚拟交换机通过软件慢路径转发模块基于报文和目标网络接口卡的虚拟功能的标识，分析报文携带的信息，决定如何处理该报文，报文处理完成之后软件慢路径转发模块将处理的过程记录下来并生成报文对应的精确流表，上述软件慢路径转发模块针对报文分析、处理以及生成报文对应的精确流表的过程也可以称为报文的“慢路径转发”。换句话说，经过虚拟交换机的报文处理过程可以称为“慢路径转发”。而在本申请其它实施例中，“快路径转发”指的是不经过虚拟交换机，而直接在网络接口卡基于卸载流表匹配进行报文处理的过程。其中，所述虚拟交换机基于所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识确定与所述报文对应的精确流表，具体可以是根据报文的上面描述的匹配信息和所述虚拟功能的标识确定与所述报文对应的精确流表。
步骤S707，所述虚拟交换机确定所述报文对应的精确流表是否满足卸载条件。
具体地，在虚拟交换机通过核心慢路径转发模块确定定与所述报文对应的精确流表后，虚拟机交换机通过多网络接口卡智能卸载引擎模块判断是否可以将报文对应的精确流表卸载至网络接口卡，即判断所述报文对应的精确流表是否满足卸载条件。
在一种可能的实现方式中，所述虚拟交换机确定所述报文对应的精确流表满足卸载条件，包括：所述虚拟交换机根据所述报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或所述虚拟交换机根据所述报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。由于网络接口卡的存储空间有限，难以存储大量的硬件流表。若发送所述报文的虚拟机与所述虚拟交换机的连接状态不稳定或发送所述报文的虚拟机的流速率小于预设阈值，则无需将报文对应的精确流表卸载至网络接口卡，以避免占用网络接口卡的存储空间，降低网络接口卡的报文处理效率。在所述虚拟交换机确定所述报文对应的精确流表满足卸载条件的情况下，所述虚拟交换机通过第一端口将所述精确流表卸载至所述N个网络接口卡。
在上述步骤S701至步骤S707对应的实施例中，目标虚拟机向目标网络接口卡发送报文，目标网络接口卡在查询到内部不存在与报文对应的卸载流表时，向虚拟交换机发送消息，虚拟交换机根据该消息确定与报文对应的精确流表，并在确定所述精确流表满足卸载条件的情况下，通过与主机连接的所有网络接口卡聚合形成的第一端口将所述精确流表卸载至所述所有的网络接口卡，从而一方实现了在网络接口卡中完成对报文的处理过程，无需主机来处理，减轻主机的负担，有效利用网络接口卡等硬件资源，提高系统的可靠性，另一方面解决了可能出现的在将精确流表卸载到单一网络接口卡或基于单一网络接口卡进行报文处理的过程中，该网络接口卡故障而导致业务终止的问题，虚拟交换机将精确流表卸载至与主机连接的所有网络接口卡，使得在任一网络接口卡故障时，虚拟交换机可以切换至其它网络接口卡，从而保证报文处理业务的可靠性，同时还可以避免N个逻辑端口分别对应不同的端口标识所可能导致的物理交换机和虚拟交换机之间数据回环，进而影响系统的性能甚至导致报文处理异常的问题。
如图6所示出的物理机架构示意图所示，目标虚拟机的虚拟网卡的工作模式可包括软直通模式和硬直通模式。当虚拟机的虚拟网卡被配置为硬直通模式时，虚拟机与网络接口卡直接连接；当虚拟机的虚拟网卡被配置为软直通模式时，虚拟机通过虚拟交换机与网络接口卡连接。
在一种可能的实现方式中，在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，上述步骤S702：目标虚拟机向所述目标网络接口卡发送报文包括以下步骤S702a至S702c。
S702a，所述目标虚拟机向所述虚拟交换机发送所述报文；所述虚拟交换机通过第二端口接收所述目标虚拟机发送的所述报文，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；S702b，所述虚拟交换机从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；S702c，所述虚拟交换机将所述报文发送至所述目标虚拟功能；
在一种可能的实现方式中，在所述目标虚拟机的虚拟网卡的工作模式被配置为硬直通模式时，上述步骤S702：目标虚拟机向所述目标网络接口卡发送所述报文包括以下步骤S702d至S702e：
S702d，所述目标虚拟机从所述N个网络接口卡对应的N个虚拟功能中确定所述目标虚拟功能；S702e，所述目标虚拟机通过第三端口向所述目标虚拟功能发送所述报文，其中，所述第三端口为所述N个虚拟功能在所述目标虚拟机内聚合形成的逻辑端口。
具体地，在上述步骤S702a-步骤S702e对应的实施例中，虚拟机的虚拟网卡可以配置为硬直通模式和软直通模式，在检测到硬直通模式(或软直通模式)故障时，可以自动切换到软直通模式(或硬直通模式)继续提供服务，从而解除硬件规格限制，按场景按需使用。
对于虚拟机的虚拟网卡被配置为硬直通的场景，每个网络接口卡各确定一虚拟功能与虚拟机的虚拟网卡对应，虚拟机将N个网络接口卡对应的N个虚拟功能聚合形成一逻辑端口，即第三端口VM bond模块。对于虚拟机的虚拟网卡被配置为软直通(Virtio)的场景，虚拟交换机从N个网络接口卡上各确定一虚拟功能与虚拟机的虚拟网卡对应，虚拟交换机 在软直通进程将N个网络接口卡对应的N个虚拟功能聚合形成一逻辑端口，即第二端口VF bond模块。虚拟网卡的后端与第二端口构成端对端(peer to peer)的关系。因此，在虚拟机的虚拟网卡被配置为软直通时，报文的传输就通过软直通进程完成，其中，基于软直通进程完成的报文传输采用零拷贝机制。
在一种可能的实现方式中，在上述步骤S701-步骤S707执行之后，还可以包括以下步骤S708：所述目标网络接口卡基于所述卸载的精确流表对所述报文进行处理。
具体地，所述虚拟交换机通过第一端口将所述精确流表卸载至所述N个网络接口卡后，当与所述报文同一数据流的后续报文进入网络接口卡时，网络接口卡会直接根据报文从存储的卸载流表中命中报文对应的卸载流表，继而直接执行卸载流表中指示的行为(或操作)，例如向指定端口输出、打上或剥除VLAN Tag、打上或剥除VxLAN头、修改数据包头、跳转至其它流表、丢弃以及执行CT行为等，以完成对报文的处理，无需在上报至虚拟交换机，能够更快地被处理，从而提高报文的处理效率。其中，虚拟机确定的与所述报文对应的精确流表可以包括多个，网络接口卡在接收到同一数据流的后继报文后，基于报文关联的卸载的多个精确流表的执行域进行处理。
在一种可能的实现方式中，在上述步骤S704执行之后，在所述目标网络接口卡查询到内部存在与所述报文对应的卸载流表时，也可以执行步骤S708，所述目标网络接口卡基于所述卸载流表对所述报文进行处理。
具体地，报文的转发可分为慢路径转发和快路径转发，在目标网络接口卡接收到虚拟机发送的报文后，查询内部是否存在与报文对应的卸载流表。在目标网络接口卡查询到内部存在与报文对应的卸载流表时，执行报文的快路径转发，即目标网络接口卡直接基于内部存储的卸载流表对所述报文进行处理。在目标网络接口卡查询到内部不存在与报文对应的卸载流表时，执行报文的慢路径转发，即将报文和目标网络接口卡接收报文的虚拟功能的标识上送至虚拟交换机，由虚拟交换机针对报文和虚拟功能的标识进行慢路径转发学习，确定报文对应的精确流表进而将精确流表卸载至目标网络接口卡，再由目标网络接口卡基于卸载的精确流表对报文进行处理。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。所述方法还包括：所述虚拟交换机在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
具体地，由于虚拟交换机在确定所述报文对应的精确流表满足卸载条件的情况下，将精确流表卸载至主机连接的所有网络接口卡(即N个网络接口卡)，因此，针对N个网络接口卡，任意两个网络接口卡中存储的卸载流表相同。网络接口卡中存储的卸载流表组成卸载流表集合，任意两个网络接口卡对应的两个卸载流表集合中相同的卸载流表关联至精 确流表集合中一对应的精确流表。举例来说，第一网络接口卡和第二网络接口卡连接主机，主机中存储有满足卸载条件的精确流表0a，精确流表0b，精确流表0c，精确流表0d。可选地，主机中还可以包括不满足卸载条件的其它精确流表，不满足卸载条件的其它精确流表未在本发明实施例举例列出。主机中存储有精确流表组成精确流表集合。将主机中存储的满足卸载条件的精确流表集合卸载至网络接口卡，便生成了网络接口卡对应的卸载流表集合。因此，第一网络接口卡存储第一卸载流表集合，第二网络接口卡存储第二卸载流表集合，第一卸载流表集合和第二卸载流表集合中包括的卸载流表完全相同，即，第一卸载流表集合包括卸载流表1a，卸载流表1b，卸载流表1c，卸载流表1d，第二卸载流表集合中包括卸载流表2a，卸载流表2b，卸载流表2c，卸载流表2d。其中，卸载流表1a和卸载流表2a相同，卸载流表1b和卸载流表1b相同，卸载流表1c和卸载流表2c相同，卸载流表1d和卸载流表2d相同。相同的卸载流表1a和2a均与精确流表0a对应，相同的卸载流表1b和2b均与精确流表0b对应，相同的卸载流表1c和2c均与精确流表0c对应，相同的卸载流表1d和2d均与精确流表0d对应。虚拟交换机在通过多网络接口卡智能卸载引擎模块检测到任意一个网络接口卡中存储的任一卸载流表被删除时，向所述N个网络接口卡除所述任意一个网络接口卡外的其它网络接口卡发送删除指令，以指示其它网络接口卡删除存储的与所述目标卸载流表相同的卸载流表，从而实现多网络接口卡之间卸载流表的统一管理。
本申请实施例中，物理机可以根据链表技术将网络接口卡中存储的卸载流表链接到虚拟交换机中的精确流表，当虚拟交换机中的精确流表删除或更改的时候，以及当任一网络接口卡中存储的卸载流表被删除的时候，主机会通知网络接口卡同步删除或者修改卸载流表。
在一种可能的实现方式中，所述方法还包括：所述虚拟交换机在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议(Transmission Control Protocol，TCP)连接状态变化中的一种或多种。
具体地，虚拟交换机在通过多网络接口卡智能卸载引擎模块检测到一报文对应的精确流表变更时，将更新后的精确流表卸载至N个网络接口卡，以指示N个网络接口卡基于新卸载的报文对应的精确流表更新该报文对应原有的卸载流表，以实现多网络接口卡之间卸载流表的统一管理。
其中，因为网络接口卡的存储空间有限，或者分配给卸载流表的存储空间有限，当目标报文对应的卸载流表或精确流表长时间未被访问时，则启动老化机制，即将一段时间未被访问的卸载流表或精确流表被删除，从而节省存储空间。TCP连接是指客户机和物理机之间建立的网络连接。在客户机和物理机之间建立正常的TCP网络连接时，客户机首先发出一个握手信号，物理机使用SYN+ACK应答表示接收到了这个消息，最后客户机再以ACK消息响应，这样在客户机和物理机之间才能建立起可靠的TCP连接，数据才可以在客户机和物理机之间传递。检测到TCP连接状态可以包括接收到TCP的建链请求和接收到针对TCP删除链路的请求，一旦发现是删除请求，则网络接口卡可以删除该客户发送的报文对 应的卸载流表，避免占用空间。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同，所述方法还包括：所述虚拟交换机在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；所述虚拟交换机向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
具体地，由于虚拟交换机在确定所述报文对应的精确流表满足卸载条件的情况下，将精确流表卸载至主机连接的所有网络接口卡(即N个网络接口卡)，因此，针对N个网络接口卡，任意两个网络接口卡中存储的卸载流表相同。卸载至网络接口卡的精确流表成为网络接口卡中存储的卸载流表，网络接口卡中存储的卸载流表组成卸载流表集合，任意两个网络接口卡对应的两个卸载流表集合中相同的卸载流表关联。举例来说，第一网络接口卡和第二网络接口卡连接主机，虚拟交换机内部存储有精确流表集合，精确流表集合中满足卸载条件的精确流表卸载至第一网络接口卡组成第一卸载流表集合，卸载至第二网络接口卡组成第二卸载流表集合，第一卸载流表集合和第二卸载流表集合中包括的卸载流表完全相同，即，第一卸载流表集合包括卸载流表1a，卸载流表1b，卸载流表1c，卸载流表1d，第二卸载流表集合中包括卸载流表2a，卸载流表2b，卸载流表2c，卸载流表2d。其中，卸载流表1a和卸载流表2a相同，卸载流表1b和卸载流表1b相同，卸载流表1c和卸载流表2c相同，卸载流表1d和卸载流表2d相同。虚拟交换机存储的精确流表集合中包括满足卸载条件的精确流表包括：精确流表0a，精确流表0b，精确流表0c，精确流表0d。可选地，主机中还可以包括不满足卸载条件的其它精确流表，不满足卸载条件的其它精确流表未在本发明实施例举例列出。虚拟交换机通过多网络接口卡智能卸载模块将相同的卸载流表1a和卸载流表2a关联至精确流表0a，相同的卸载流表1b和卸载流表2b关联至精确流表0b，相同的卸载流表1c和卸载流表2c关联至精确流表0c，卸载流表1d和卸载流表2d关联至精确流表0d，从而方便虚拟交换机通过多网络接口卡智能卸载模块实现多网络接口卡卸载流表的管理。举例来说，虚拟交换机通过虚拟交换机绑定模块在检测到第二网络接口卡的状态异常时，一方面通过虚拟交换机绑定模块解除第二网络接口卡对应的逻辑端口与第一网络接口卡对应的逻辑端口的聚合，另一方面虚拟交换机向所述第二网络接口卡发送标记指令，以指示第二个网络接口卡将第二卸载流表集合中包括的卸载流表1a，卸载流表1b，卸载流表1c和卸载流表1d标记为无效；并通过多网卡智能卸载引擎模块解除卸载流表1a和精确流表0a的关联，解除卸载流表1b和精确流表0b的关联，解除卸载流表1c和精确流表0c的关联，解除卸载流表1d和精确流表0d的关联。
其中，被标记为无效的卸载流表被老化线程回收。虚拟交换机通过虚拟交换机绑定模块将状态异常的网络接口卡的虚拟功能链路状态被设置为down，从而触发状态异常的网络 接口卡的虚拟功能状态为down，进而通过虚拟交换机绑定模块执行虚拟功能相关链路的切换，切换至与主机连接的其它网络接口卡，由其它网络接口卡完成IO通信，保证链路的可靠性。
在一种可能的实现方式中，所述方法还包括：当所述第二网络接口卡状态正常时，所述虚拟交换机将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；所述虚拟交换机将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；所述虚拟交换机建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
具体地，虚拟交换机的虚拟交换机绑定模块在检测到状态异常的网络接口卡恢复正常时，该网络接口卡内部的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口，以形成第一级绑定；虚拟交换机绑定模块将该网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口设置为对应目标端口标识，以恢复该网络接口卡与其它网络接口卡的聚合，即恢复第二级绑定。由于在与主机连接的除恢复正常外的其它网络接口卡中，任意两个网络接口卡中存储的卸载流表相同，因此虚拟交换机通过多网络接口卡智能卸载模块将虚拟交换机内存储的精确流表集合中的精确流表卸载至状态恢复正常的网络接口卡，并建立该网络接口卡对应的卸载流表集合与精确流表集合的映射关系，从而实现所述状态恢复正常的网络接口卡对应的卸载流表集合与精确流表集合以及所述其它网络接口卡对应的卸载流表集合中相同流表关联，从而实现多网络接口卡之间卸载流表的统一管理。
通过以上实施例，可以实现多网络接口卡卸载流表的管理，即实现多网络接口卡卸载流表的新建，老化，删除等，支持不同网络接口卡之间卸载流表一致性校验。
在一种可能的实现方式中，在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，所述目标虚拟机向所述目标网络接口卡发送报文，还包括：所述目标虚拟机配置虚拟网卡的队列数为K并将待发送的数据流分为K个队列，其中，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表；所述虚拟交换机通过所述第二端口接收所述目标虚拟机发送的所述数据流；所述虚拟交换机将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，K为N的整数倍，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
其中，目标虚拟机向网络接口卡发送报文可以包括目标虚拟机向N个网络接口卡中的目标网络接口卡发送报文，由目标网络接口卡完成报文的处理。目标虚拟机向网络接口卡发送报文还可以包括目标虚拟机向N个网络接口卡中的多个网络接口卡发送报文，由多个网络接口卡共同完成报文的处理，以加快报文的处理效率。在本申请实施例中，以目标虚拟机向N个网络接口卡发送报文，由N个网络接口卡共同完成报文的处理为例，虚拟机的虚拟网卡配置队列数K，在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，目标虚拟机将报文发送虚拟交换机的软直通模块。软直通模块通过零拷贝方式接受目标虚 拟机发送的报文。软直通模块将报文通过VF bond模块发送至N个网络接口卡对应的N个虚拟功能。每个虚拟功能负责K/N个队列的报文的转发。虚拟网卡的K个队列和N个网络接口卡对应的N个虚拟功能组成的队列建立了对应的关系。其中，上述“零拷贝”具体指报文由所述目标虚拟机的内存直接拷贝至网络接口卡的内存，所述虚拟交换机通过第二端口接收所述报文以及将所述报文发送至所述虚拟功能时不进行报文的拷贝。具体地，在将报文由虚拟机发送至网络接口卡的过程中，由于在软直通场景下报文需要虚拟交换机进行报文的搬运，因此一般需要报文需要先拷贝至主机的内存，再由主机的内存拷贝至网络接口卡。然后，在本申请实施例中，在软直通场景下，虚拟机虚拟网卡的队列和网络接口卡虚拟功能的队列存在对应关系，在报文由虚拟机发送至网络接口卡时，软直通模块直接将虚拟机的内存映射至网络接口卡的内存，即实现网络接口卡针对虚拟机的内存直接执行直接存储器访问(Direct Memory Access，DMA)，通过虚拟网卡的队列和硬件网卡VF的队列绑定，实现报文传输的零拷贝。同理，在目标虚拟机接收网络接口卡发送的报文时，报文由网络接口卡的内存直接拷贝至所述目标虚拟机的内存，所述虚拟交换机通过第二端口接收网络接口卡发送的报文以及所述虚拟交换机将所述报文发送至所述目标虚拟机时，所述虚拟交换机不进行报文的拷贝。
具体地，图7对应的实施例的产品形态可以包含在物理机的软件中，部署在云平台的计算节点上。运行时，图7对应的实施例的程序代码可以运行于物理机的主机内存和网络接口卡的硬件内存中。
参见图8，图8是本发明实施例提供的另一种流表处理方法的流程示意图，该方法可应用于上述图5中所述的物理机架构中的虚拟交换机102，其中的虚拟交换机102可以用于支持并执行图8中所示的方法流程步骤S801和步骤S802。下面将结合附图8从虚拟交换机单侧进行描述。所述虚拟交换机连接M个虚拟机和N个网络接口卡，M、N为大于或者等于2的整数，该方法可以包括以下步骤S803和步骤S804，可选地，还可以包括步骤S805-步骤S807。
步骤S801，虚拟交换机建立所述N个逻辑端口的N个端口标识与所述目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为所述第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口。
步骤S802，虚拟交换机通所述过第一端口将精确流表卸载至所述N个网络接口卡。
可选地，在上述步骤S802执行之前，还可以包括以下步骤S803和步骤S804。
步骤S803，虚拟交换机接收目标网络接口卡发送的消息，所述消息携带所述目标网络接口卡接收到的报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，所述消息是所述目标网络接口卡在接收到所述报文后查询到内部不存在与所述报文对应的卸载流表后发送的，所述目标网络接口卡是所述N个网络接口卡中的其中一个。
步骤S804，虚拟交换机基于所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，确定所述精确流表，所述精确流表用于指示对所述报文的处理。
可选地，在上述步骤S801-步骤S804执行之前，还可以包括以下步骤S805-步骤S807。
步骤S805，虚拟交换机通过第二端口接收目标虚拟机发送的所述报文，所述目标虚拟机是所述M个虚拟机中的任意一个，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口。
步骤S806，虚拟交换机从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能。
步骤S807，虚拟交换机将所述报文发送至所述目标虚拟功能，以使所述目标虚拟功能对应的所述目标网络接口卡根据所述报文查询是否存在与所述报文对应的卸载流表。
可选地，在虚拟交换机通过第一端口将所述精确流表卸载至所述N个网络接口卡之前，所述方法还包括如下步骤S808：虚拟交换机确定所述精确流表满足卸载条件。其中，所述确定所述精确流表满足卸载条件，包括：根据所述精确流表对应的报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或根据所述精确流表对应的报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同，所述方法还包括：虚拟交换机在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
在一种可能的实现方式中，所述方法还包括：虚拟交换机在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同，所述方法还包括：在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
在一种可能的实现方式中，所述方法还包括：当所述第二网络接口卡状态正常时，将 所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；建立所述第二网络接口卡对应的卸载流表集合与所述精确流表集合的映射关系。
在一种可能的实现方式中，所述接收目标网络接口卡发送的消息之前，所述方法还包括：通过所述第二端口接收所述目标虚拟机发送的数据流，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表，所述数据流被分为K个队列；将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，K为N的整数倍，所述目标虚拟机的虚拟网卡被配置为K个队列，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
基于上述物理机架构，本发明实施例提供又一种流表处理方法的流程示意图。如图9和图10所示，此处虚拟交换机以eVS为例，网络接口卡以Hi1822网络接口卡为例，其中，第一虚拟机的虚拟网卡被配置为硬直通模式，第二虚拟机机的虚拟网卡被配置为软直通模式，该流表处理方法包括步骤(1)至(6)。
(1)物理机创建vSW网络Bond拓扑。首先，物理机创建vSW对象，通过在虚拟交换机框架上创建虚拟交换机对象来构建所述虚拟交换机的拓扑结构，并且为所述虚拟交换机添加一个或多个端口以形成所述拓扑结构。其中，创建vSW对象和现有流程保持一致，此处不再赘述。其次，创建跨网络接口卡两级LACP bond。第一级，每个网络接口卡的物理端口基于LACP聚合形成的逻辑端口，即第一网络接口卡和第二网络接口卡各自提供一个链路级的两端口的LACP聚合Hwbond-A和Hwbond-B，这两个LACP聚合Hwbond-A和Hwbond-B被设置为对应目标端口标识sysid；第二级，eVS在软件层面将两个LACP聚合抽象合并成一个4端口的LACP聚合。其中，物理机交换机也相应地开启动态LACP技术，由于两个网络接口卡对应的两个LACP聚合被设置为对应目标端口标识sysid，因此在物理交换机侧也同样地可以协商出一个4端口的LACP聚合。
(2)物理机初始化多网络接口卡智能卸载引擎模块。物理机初始化多网络接口卡智能卸载引擎包括：(a)初始化每个网络接口卡的硬件datapath模块，即第一网络接口卡中包括的第一硬件datapath模块和第二网络接口卡中包括的第二硬件datapath模块；(b)为每个网络接口卡分配一个网络接口卡标识，该网络接口卡标识用于指示数据流从哪个网络接口卡收到的以及卸载流表与网络接口卡的关联关系。
(3)物理机创建虚拟机实例。
本申请实施例中，网络接口卡通过网络接口卡端口与虚拟机互联，一个网络接口卡端口可以通过SR-I/OV技术与主机上运行的一个虚拟机连接，网络接口卡端口可以为SR-I/OV技术定义的虚拟功能的端口。在本发明实施例中，网络接口卡还可以使用其它技术与虚拟机互联，本发明实施例不对网络接口卡与虚拟机互联的技术进行限定。网络接口卡还可以 为支持虚拟机设备队列(Virtual Machine Device Queues，VMDq)功能的网络接口卡。物理机配置虚拟机与网络接口卡互联的端口可以包括以下步骤：
(a)物理机的主机根据虚拟交换机端口的配置信息，在虚拟交换机上建立至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个虚拟机。举例来说，物理机上运行有第一虚拟机和第二虚拟机，第一虚拟机对应的虚拟网卡为虚拟网卡1，第二虚拟机对应的虚拟网卡为虚拟网卡2，虚拟交换机具有端口1和端口2，那么设置端口1对应虚拟网卡1，设置端口2对应虚拟网卡2，即虚拟交换机不同的端口对应不同的虚拟网卡进而对应不同的虚拟机。
(b)主机生成网络接口卡端口的配置信息，并将该网络接口卡端口的配置信息发送至物理机的网络接口卡。具体地，该主机获取该虚拟交换机端口的配置信息，将该虚拟交换机端口的配置信息发送至该主机上运行的网络接口卡驱动，该网络接口卡驱动根据该虚拟交换机端口的配置信息，生成网络接口卡端口的配置信息，并发送至该网络接口卡。该虚拟交换机端口的配置信息与该网络接口卡端口的配置信息的功能类似，该网络接口卡驱动将虚拟交换机端口的配置信息转换为网络接口卡端口的配置信息主要为了符合网络接口卡驱动与网络接口卡通信的规范。
(c)该网络接口卡根据该网络接口卡端口的配置信息，在该网络接口卡上配置至少一个网络接口卡端口，每个网络接口卡端口与该主机上运行的一个虚拟机连接。举例来说，本申请实施例中，物理机从两个网络接口卡各分配一个虚拟功能与虚拟机的虚拟网卡绑定。网络接口卡端口具体可以为SR-I/OV技术定义的虚拟功能的端口。因此，虚拟交换机的每一个端口与网络接口卡的一个虚拟功能相对应，网络接口卡通过虚拟功能与虚拟机互联。
上述步骤(a)至(c)为可选步骤，且步骤(a)至(c)为该虚拟交换机和该网络接口卡的配置过程，无须每次执行(a)至(c)的后续步骤前都执行一次(a)至(c)。通过该配置过程，主机上运行的虚拟机通过网络接口卡端口与网络接口卡连接。
可选的，物理机创建虚拟机实例还包括配置该虚拟交换机与该网络接口卡通信的至少一个队列，用于该虚拟交换机将从网络接口卡接收到的数据包返回给该网络接口卡。队列的配置有多种形式，例如，该虚拟交换机与该网络接口卡通过一个队列通信，该虚拟交换机将需要发往该网络接口卡的全部数据包发送至该队列，再例如，该虚拟交换机与该网络接口卡通过K个队列通信，其中K为网络接口卡数量N的整数倍，每一个队列与一个网络接口卡对应。本发明实施例并不限定队列的配置形式。
虚拟机的虚拟网卡的工作模式包括软直通工作模式和硬直通工作模式。无论虚拟网卡的工作模式被配置为软直通工作模式和硬直通工作模式，报文的转发均可以分为慢路径转发和快路径转发。综合考虑虚拟网卡的工作模式以及报文的转发，将报文的转发路径归纳如下11所示。其中，图5对应的服务器架构中，任意一个虚拟机101都可以作为图11中的源虚拟机将报文发送其它虚拟机101，任意一个虚拟机101也可以作为目的虚拟机接收其它虚拟机发送的报文。任意一个网络接口卡105都可以作为本申请中的第一网络接口卡以及第二网络接口卡。对于Virtio软直通场景：将vSW对象上创建虚拟网卡的代理端口信息和以及两个网络接口卡各自对应的一个虚拟功能与虚拟机的虚拟网卡的绑定关系通知Virtio软直通模块，创建VF Bond与虚拟网卡后端设备执行绑定操作。在一种可选的实施 方式中，物理机还利用多队列机制，将虚拟机的虚拟网卡配置队列数为M(建议为偶数)时，软直通内VF Bond模块的每个虚拟功能负责其中M/2个队列的流量收发，Virtio虚拟网卡和虚拟功能队列建立了一一对应关系，软直通模块通过零拷贝的方式收发报文。对于VF硬直通场景，在虚拟机内创建VM Bond作为网络接口。
(4)物理机执行首包慢路径学习。如图10所示，当虚拟机的虚拟网卡被配置为硬直通工作模式时，第一虚拟机发送报文时，通过内部VM bond基于哈希算法选择某个虚拟功能，到达扩展出该虚拟功能的网络接口卡。可选地，当虚拟机的虚拟网卡被配置为软直通工作模式时，第一虚拟机发送报文时，首先报文到达虚拟交换机的软直通模块，软直通模块通过内部VF bond基于哈希算法选择某个虚拟功能，进而到达扩展出该虚拟功能的硬件网络接口卡，其中，图10仅仅示意了第一虚拟机的虚拟网卡被配置为硬直通工作模式的场景，第一虚拟机的虚拟网卡被配置为软直通工作模式的场景未在图10中示出。在网络接口卡硬件datapath模块内部查找是否存在报文对应的卸载流表，没有命中。硬件网络接口卡产生消息，即硬件upcall。该硬件upcall携带报文、虚拟功能标识，vSW通过对应虚拟网卡代理端口收到该报文。vSW通过软件慢路径模块对报文做软件慢路径转发，执行安全检查、状态更新和目的位置查找等逻辑，结果通知多网络接口卡智能卸载引擎模块。多网络接口卡智能卸载引擎模块根据状态、报文执行Action集合和流量大小智能决策是否生成卸载流表，若不满足则放弃本次卸载。若可以安装卸载流表，则多网络接口卡智能卸载引擎模块将报文对应的精确载流表同时下发给与虚拟交换机连接的所有的网络接口卡的硬件datapath模块，并在多网络接口卡智能卸载引擎模块中记录卸载流表与网络接口卡标识的关联关系，以及不同网络接口卡对应的相同的卸载流表之间的关联关系。其中，报文Action集合分为两个部分，第一部分用于指示针对报文的报文头进行何种修改，第二部分用于指示网络接口卡报文从哪个端口发出去。
(5)物理机执行卸载流表快路径转发。
第一虚拟机发送报文时，当第一虚拟机的虚拟网卡被配置为硬直通工作模式时，如10所示，通过第一虚拟机内部VM bond基于Hash算法选择某个虚拟功能，到达扩展出该虚拟功能的网络接口卡。当虚拟机的虚拟网卡被配置为软直通工作模式时，第一虚拟机发送报文时，报文到达虚拟交换机的软直通模块，软直通模块通过内部VF bond基于哈希算法选择某个虚拟功能，进而到达扩展出该虚拟功能的网络接口卡。在网络接口卡硬件datapath模块内部查找卸载流表，基于报文对应的卸载流表，将报文直接转发给其它虚拟机或外部网络。其中，图10仅仅示意了第一虚拟机的虚拟网卡被配置为硬直通工作模式，第二虚拟机的虚拟网卡被配置为软直通工作模式的场景，其它场景未在图10中示出。
(6)物理机在检测到卸载流表变更和网络接口卡状态变更时，进行卸载流连接和Bond状态处理。
其中，卸载流表变更包括以下触发条件：慢路径转发规则变更、报文连接老化、虚拟机端口删除、TCP连接状态变化等。在多网络接口卡智能卸载引擎模块检测到上述触发条件时，将更新的精确流表卸载至与虚拟交换机连接的网络接口卡。当检测到与虚拟交换机连接的其中一个网络接口卡中某个卸载流表被删除时，同时清理与虚拟交换机连接的除上述网络接口卡外的其它网络接口卡中的关联卸载流表。
当vSW-Bond模块检测到某个网络接口卡状态异常(无法工作)时，将状态异常的网络接口卡从Bond中移除，并立即通知多网络接口卡智能卸载引擎模块。多网络接口卡智能卸载引擎模块查找内部保存的精确流表，将状态异常的网络接口卡对应的精确流表标记为无效，并解除与虚拟交换机连接的除状态异常的网络接口卡的其它网络接口卡上相关卸载流表的关联。标记为无效的卸载流表最终由老化线程回收释放。同时将异常的网络接口卡VF链路状态设置为down，从而触发相应网络接口卡的VF状态为down，执行VF bond的相关链路切换。当网络接口卡恢复正常工作时，vSW-Bond模块重新将其加入Bond，并通知多网卡智能卸载引擎模块。多网卡智能卸载引擎模块将另外一个网络接口卡的卸载流表复制一份，下发给恢复正常工作的网络接口卡，并记录恢复正常工作的网络接口卡的网络接口卡标识与卸载流表的关联关系。
上述详细阐述了本发明实施例的方法，下面提供了本发明实施例的相关装置。
请参见图12，图12是本发明实施例提供的一种流表处理装置900的结构示意图，该流表处理装置可以包括建立单元901和卸载单元902，其中，各个单元的详细描述如下。
建立单元901，用于建立所述N个逻辑端口的N个端口标识与所述目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为所述第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口。
卸载单元902，用于通过所述第一端口将报文对应的精确流表卸载至所述N个网络接口卡。
在一种可能的实现方式中，所述装置还包括。
第一接收单元903，用于接收目标网络接口卡发送的消息，所述消息携带所述目标网络接口卡接收到的报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，所述消息是所述目标网络接口卡在接收到所述报文后查询到内部不存在与所述报文对应的卸载流表后发送的，所述目标网络接口卡是所述N个网络接口卡中的其中一个。
确定单元904，用于基于所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，确定与所述报文对应的精确流表。
在一种可能的实现方式中，所述装置还包括：
第二接收单元905，还用于通过第二端口接收目标虚拟机发送的所述报文，所述目标虚拟机是所述M个虚拟机中的任意一个，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；
所述确定单元904，还用于从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；
所述装置还包括：
发送单元906，用于将所述报文发送至所述目标虚拟功能，以使所述目标虚拟功能对应的所述目标网络接口卡根据所述报文查询是否存在与所述报文对应的卸载流表。
在一种可能的实现方式中，所述卸载单元902还用于确定所述报文对应的精确流表满足卸载条件的情况。其中在用于确定所述报文对应的精确流表满足卸载条件时，所述卸载单元902具体用于：根据所述报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状 态稳定；和/或根据所述报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同，所述装置还包括第一更新单元907，第一更新单元907用于在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
在一种可能的实现方式中，所述装置还包括第二更新单元908，第二更新单元908用于在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
在一种可能的实现方式中，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同，所述装置还包括第三更新单元909，第三更新单元909用于在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
在一种可能的实现方式中，所述第三更新单元909，还用于当所述第二网络接口卡状态正常时，将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
在一种可能的实现方式中，所述第二接收单元905还用于通过所述第二端口接收所述目标虚拟机发送的数据流，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表，所述数据流被分为K个队列。所述发送单元906，还用于将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，其中，K为N的整数倍，所述目标虚拟机的虚拟网卡被配置为K个队列，所 述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
需要说明的是，本发明实施例中所描述的流表处理装置900中各功能单元的功能可参见上述图7和图8中所述的方法实施例中步骤S701-步骤S708和步骤S801-步骤S807的相关描述，此处不再赘述。
如图13所示，图13是本发明实施例提供的一种物理机10的结构示意图，该物理机10包括至少一个处理器601，至少一个存储器602、至少一个通信接口603。此外，该设备还可以包括天线等通用部件，在此不再详述。
处理器601可以是通用中央处理器(CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制以上方案程序执行的集成电路。
通信接口603，用于与其它设备或通信网络通信，如以太网，无线接入网(RAN)，核心网，无线局域网(Wireless Local Area Networks，WLAN)等。
存储器602可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器可以是独立存在，通过总线与处理器相连接。存储器也可以和处理器集成在一起。
其中，所述存储器602用于存储执行以上方案的应用程序代码，并由处理器601来控制执行。所述处理器601用于执行所述存储器602中存储的应用程序代码。
存储器602存储的代码可执行以上图5提供的流表处理方法，比如建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与一目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；通过所述第一端口将报文对应的精确流表卸载至所述N个网络接口卡。
需要说明的是，本发明实施例中所描述的物理机60中各功能单元的功能可参见上述图7和图8中所述的方法实施例中步骤S701-步骤S708和步骤S801-步骤S807的相关描述，此处不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其它实施例的相关描述。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可能可以采用其它顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本 申请所必须的。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以为个人计算机、服务端或者网络设备等，具体可以是计算机设备中的处理器)执行本申请各个实施例上述方法的全部或部分步骤。其中，而前述的存储介质可包括：U盘、移动硬盘、磁碟、光盘、只读存储器(Read-Only Memory，缩写：ROM)或者随机存取存储器(Random Access Memory，缩写：RAM)等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (37)

  1. 一种流表处理方法，应用于虚拟交换机，所述虚拟交换机连接M个虚拟机和N个网络接口卡，M、N为大于或者等于2的整数，其特征在于，所述方法包括：
    建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与一目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；
    通过所述第一端口将精确流表卸载至所述N个网络接口卡。
  2. 根据权利要求1所述的方法，其特征在于，所述通过所述第一端口将所述精确流表卸载至所述N个网络接口卡之前，所述方法还包括：
    接收目标网络接口卡发送的消息，所述消息携带所述目标网络接口卡接收到的报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，所述消息是所述目标网络接口卡在接收到所述报文后查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表后发送的，所述目标网络接口卡是所述N个网络接口卡中的其中一个；
    基于所述报文和所述虚拟功能的标识，确定所述精确流表，所述精确流表用于指示对所述报文的处理。
  3. 根据权利要求2所述的方法，其特征在于，所述在接收目标网络接口卡发送的消息之前，所述方法还包括：
    通过第二端口接收目标虚拟机发送的所述报文，所述目标虚拟机是所述M个虚拟机中的任意一个，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；
    从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；
    将所述报文发送至所述目标虚拟功能，以使所述目标虚拟功能对应的所述目标网络接口卡根据所述报文查询是否存在与所述报文对应的卸载流表。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述通过所述第一端口将所述精确流表卸载至所述N个网络接口卡之前，所述方法还包括：
    确定所述精确流表满足卸载条件；
    其中，所述确定所述精确流表满足卸载条件，包括：
    根据所述精确流表对应的报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或
    根据所述精确流表对应的报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一 卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
  8. 根据权利要求5至7任一项所述的方法，其特征在于，所述方法还包括：
    在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；
    向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    当所述第二网络接口卡状态正常时，将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；
    将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；
    建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
  10. 根据权利要求3所述的方法，其特征在于，所述接收目标网络接口卡发送的消息之前，所述方法还包括：
    通过所述第二端口接收所述目标虚拟机发送的数据流，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表，所述数据流被分为K个队列；
    将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，K为N的整数倍，所述目标虚拟机的虚拟网卡被配置为K个队列，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
  11. 一种流表处理方法，应用于物理机，所述物理机包含主机和N个网络接口卡，所述主机上运行有虚拟交换机和M个虚拟机，所述N个网络接口卡通过主机接口与主机相连，所述N个网络接口卡通过网络接口与外部网络相连，M、N为大于或者等于2的整数，所述方法包括：
    所述虚拟交换机建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与一目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为所述第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；
    目标网络接口卡接收报文，所述报文是与所述物理机连接的物理交换机发送的或是目标虚拟机发送的报文，所述目标虚拟机是所述M个虚拟机中任意一个，所述目标网络接口卡是所述N个网络接口卡中的其中一个；
    在所述目标网络接口卡查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表的情况下，所述虚拟交换机通过所述第一端口将所述报文对应的精确流表卸载至所述N个网络接口卡。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    所述目标网络接口卡在查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表时，向所述虚拟交换机发送消息，所述消息携带所述报文和所述目标网络接口卡接收所述报文的虚拟功能的标识；
    所述虚拟交换机基于所述报文和所述虚拟功能的标识，确定与所述报文对应的精确流表。
  13. 根据权利要求11或12所述的方法，其特征在于，所述方法还包括：
    所述目标网络接口卡基于所述卸载的精确流表对所述报文进行处理。
  14. 根据权利要求11至13任一项所述的方法，其特征在于，所述方法还包括：
    在所述目标网络接口卡查询到所述目标网络接口卡中存在与所述报文对应的卸载流表时，所述目标网络接口卡基于所述卸载流表对所述报文进行处理。
  15. 根据权利要求11至14任一项所述的方法，其特征在于，当所述报文是所述目标虚拟机发送的，所述方法还包括：所述目标虚拟机向所述目标网络接口卡发送报文；所述目 标虚拟机包括虚拟网卡，所述虚拟网卡的工作模式包括软直通模式和硬直通模式；
    所述目标虚拟机向所述目标网络接口卡发送报文，包括：
    在所述虚拟网卡的工作模式被配置为软直通模式时，所述目标虚拟机向所述虚拟交换机发送所述报文；所述虚拟交换机通过第二端口接收所述报文，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；所述虚拟交换机从所述N个虚拟功能中确定目标虚拟功能；所述虚拟交换机将所述报文发送至所述目标虚拟功能；
    在所述目标虚拟机的虚拟网卡的工作模式被配置为硬直通模式时，所述目标虚拟机从N个虚拟功能中确定所述目标虚拟功能；所述目标虚拟机通过第三端口向所述目标虚拟功能发送所述报文，其中，所述第三端口为所述N个虚拟功能在所述目标虚拟机内聚合形成的逻辑端口。
  16. 根据权利要求11至15项任一项所述的方法，其特征在于，所述虚拟交换机通过所述第一端口将所述报文对应的精确流表卸载至所述N个网络接口卡之前，所述方法还包括：
    所述虚拟交换机确定所述报文对应的精确流表满足卸载条件；
    其中，所述虚拟交换机确定所述报文对应的精确流表满足卸载条件，包括：
    所述虚拟交换机根据所述报文确定所述目标虚拟机与所述虚拟交换机的连接状态稳定；和/或
    所述虚拟交换机根据所述报文确定所述目标虚拟机的流速率大于或等于预设阈值。
  17. 根据权利要求11至16任一项所述的方法，其特征在于，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    所述虚拟交换机在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
  19. 根据权利要求17或18所述的方法，其特征在于，所述方法还包括：
    所述虚拟交换机在检测到预设条件时，向所述N个网络接口卡发送更新指令，所述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
  20. 根据权利要求17至19任一项所述的方法，其特征在于，所述方法还包括：
    所述虚拟交换机在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；
    所述虚拟交换机向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
  21. 根据权利要求20所述的方法，其特征在于，所述方法还包括：
    当所述第二网络接口卡状态正常时，所述虚拟交换机将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；
    所述虚拟交换机将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；
    所述虚拟交换机建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
  22. 根据权利要求14所述的方法，其特征在于，在所述目标虚拟机的虚拟网卡的工作模式被配置为软直通模式时，所述目标虚拟机向目标网络接口卡发送报文，还包括：
    所述目标虚拟机配置虚拟网卡的队列数为K并将待发送的数据流分为K个队列，其中，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表；
    所述虚拟交换机通过所述第二端口接收所述目标虚拟机发送的所述数据流；
    所述虚拟交换机将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，K为N的整数倍，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
  23. 一种流表处理装置，应用于虚拟交换机，所述虚拟交换机连接M个虚拟机和N个网络接口卡，M、N为大于或者等于2的整数，其特征在于，所述装置包括：
    建立单元，用于建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP聚合形成的逻辑端口；
    卸载单元，用于通过所述第一端口将精确流表卸载至所述N个网络接口卡。
  24. 根据权利要求23所述的装置，其特征在于，所述装置还包括：
    第一接收单元，用于接收目标网络接口卡发送的消息，所述消息携带所述目标网络接口卡接收到的报文和所述目标网络接口卡接收所述报文的虚拟功能的标识，所述消息是所述目标网络接口卡在接收到所述报文后查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表后发送的，所述目标网络接口卡是所述N个网络接口卡中的其中一个；
    确定单元，用于基于所述报文和所述虚拟功能的标识，确定所述精确流表，所述精确流表用于指示对所述报文的处理。
  25. 根据权利要求24所述的装置，其特征在于，所述装置还包括：
    第二接收单元，还用于通过第二端口接收目标虚拟机发送的所述报文，所述目标虚拟机是所述M个虚拟机中的任意一个，所述第二端口为所述N个网络接口卡对应的N个虚拟功能在所述虚拟交换机内聚合形成的逻辑端口；
    所述确定单元，还用于从所述N个网络接口卡对应的N个虚拟功能中确定目标虚拟功能；
    所述装置还包括：
    发送单元，用于将所述报文发送至所述目标虚拟功能，以使所述目标虚拟功能对应的所述目标网络接口卡根据所述报文查询是否存在与所述报文对应的卸载流表。
  26. 根据权利要求23至25任一项所述的装置，其特征在于，所述卸载单元还用于确定所述精确流表满足卸载条件；
    其中，在用于确定所述精确流表满足卸载条件时，所述卸载单元具体用于：根据所述精确流表对应的报文确定发送所述报文的虚拟机与所述虚拟交换机的连接状态稳定；和/或根据所述精确流表对应的报文确定发送所述报文的虚拟机的流速率大于或等于预设阈值。
  27. 根据权利要求23至26任一项所述的装置，其特征在于，所述虚拟交换机存储的精确流表组成一精确流表集合，所述N个网络接口卡中每个网络接口卡存储的卸载流表组成一卸载流表集合，每个卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表一一对应，N个卸载流表集合中与同一精确流表对应的N个卸载流表相同。
  28. 根据权利要求27所述的装置，其特征在于，所述装置还包括：
    第一更新单元，用于在检测到所述N个网络接口卡中的第一网络接口卡中存储的目标卸载流表被删除时，向所述N个网络接口卡除所述第一网络接口卡外的其它网络接口卡发送删除指令，所述删除指令用于指示删除存储的与所述目标卸载流表相同的卸载流表，所述第一网络接口卡为所述N个网络接口卡中任意一个网络接口卡，所述目标卸载流表是所述第一网络接口卡中存储的多个卸载流表中的任意一个。
  29. 根据权利要求27或28所述的装置，其特征在于，所述装置还包括：
    第二更新单元，用于在检测到预设条件时，向所述N个网络接口卡发送更新指令，所 述更新指令用于指示所述N个网络接口卡更新与目标报文关联的卸载流表，所述预设条件包括所述目标报文对应的慢路径转发规则发生变更、所述目标报文连接老化、虚拟机端口删除和传输控制协议TCP连接状态变化中的一种或多种。
  30. 根据权利要求27至29任一项所述的装置，其特征在于，所述装置还包括：
    第三更新单元，用于在检测到所述N个网络接口卡中第二网络接口卡的状态异常时，解除所述第二网络接口卡对应的逻辑端口与所述N个网络接口卡中除所述第二网络接口卡外的其它网络接口卡对应的逻辑端口的聚合，所述第二网络接口卡为所述N个网络接口卡中任意一个网络接口卡；向所述第二网络接口卡发送标记指令，并解除所述第二网络接口卡中存储的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系，其中，所述标记指令用于指示所述第二网络接口卡将存储的卸载流表标记为无效。
  31. 根据权利要求30所述的装置，其特征在于，所述第三更新单元，还用于当所述第二网络接口卡状态正常时，将所述第二网络接口卡对应的逻辑端口与所述其它网络接口卡对应的逻辑端口聚合；将所述精确流表集合中的精确流表卸载至所述第二网络接口卡，其中，卸载到所述第二网络接口卡的精确流表组成所述第二网络接口卡对应的卸载流表集合；建立所述第二网络接口卡对应的卸载流表集合中包括的卸载流表与所述精确流表集合中包括的满足卸载条件的精确流表的一一对应关系。
  32. 根据权利要求24所述的装置，其特征在于，
    所述第二接收单元，还用于通过所述第二端口接收所述目标虚拟机发送的数据流，所述数据流包括所述报文，所述数据流中包括的报文匹配同一卸载流表，所述数据流被分为K个队列；
    所述发送单元，还用于将所述数据流发送至所述N个网络接口卡对应的N个虚拟功能，其中，每个虚拟功能负责K/N个队列的数据流的接收，以使所述目标网络接口卡根据K/N个队列的数据流查询是否存在与所述报文对应的卸载流表，其中，K为N的整数倍，所述目标虚拟机的虚拟网卡被配置为K个队列，所述数据流基于所述虚拟网卡的K个队列与所述N个虚拟功能之间的对应关系由目标虚拟机的内存直接拷贝至所述N个网络接口卡的内存以实现所述数据流由所述目标虚拟机至所述N个网络接口卡之间的零拷贝传输。
  33. 一种物理机，物理机包含主机和N个网络接口卡，所述主机上运行有M个虚拟机和包括根据权利要求23至32任一项所述的流表处理装置的虚拟交换机，所述N个网络接口卡通过主机接口与主机相连，所述N个网络接口卡通过网络接口与外部网络相连，M、N为大于或者等于2的整数，所述M个虚拟机包括目标虚拟机，所述N个网络接口卡包括目标网络接口卡，其中：
    所述虚拟交换机，用于建立所述N个网络接口卡对应的N个逻辑端口的N个端口标识与目标端口标识之间的映射关系，以将所述N个逻辑端口聚合为所述第一端口；其中，每个网络接口卡对应的逻辑端口是每个网络接口卡的物理端口基于链路汇聚控制协议LACP 聚合形成的逻辑端口；
    所述目标网络接口卡，用于接收报文，所述报文是与所述物理机连接的物理交换机发送的或是目标虚拟机发送的报文，所述目标虚拟机是所述M个虚拟机中任意一个，所述目标网络接口卡是所述N个网络接口卡中的其中一个；
    所述虚拟交换机，还用于在所述目标网络接口卡查询到所述目标网络接口卡中不存在与所述报文对应的卸载流表的情况下，通过所述第一端口将所述报文对应的精确流表卸载至所述N个网络接口卡。
  34. 一种物理机，其特征在于，包括处理器、存储器以及通信接口，其中，所述存储器用于存储流表处理程序代码，所述处理器用于调用所述流表处理识别程序代码来执行权利要求1至10任一项所述的方法或11至22任一项所述的方法。
  35. 一种芯片系统，其特征在于，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述接口电路和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行时，权利要求1至10中任意一项所述的方法或权利要求11至22中任意一项所述的方法得以实现。
  36. 一种计算机存储介质，其特征在于，所述计算机存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述权利要求1至10任意一项所述的方法或权利要求11至22中任意一项所述的方法。
  37. 一种计算机程序，其特征在于，所述计算机程序包括指令，当所述计算机程序被计算机执行时，使得所述计算机执行根据权利要求1至10中任意一项所述的方法或权利要求11至22中任意一项所述的方法。
PCT/CN2021/104663 2020-10-31 2021-07-06 一种流表处理方法及相关设备 WO2022088743A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21884482.7A EP4228177A4 (en) 2020-10-31 2021-07-06 FLOW TABLE PROCESSING METHOD AND ASSOCIATED DEVICE
US18/307,711 US20230269182A1 (en) 2020-10-31 2023-04-26 Flow table processing method and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011206451.2A CN114531405B (zh) 2020-10-31 2020-10-31 一种流表处理方法及相关设备
CN202011206451.2 2020-10-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/307,711 Continuation US20230269182A1 (en) 2020-10-31 2023-04-26 Flow table processing method and related device

Publications (1)

Publication Number Publication Date
WO2022088743A1 true WO2022088743A1 (zh) 2022-05-05

Family

ID=81381854

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/104663 WO2022088743A1 (zh) 2020-10-31 2021-07-06 一种流表处理方法及相关设备

Country Status (4)

Country Link
US (1) US20230269182A1 (zh)
EP (1) EP4228177A4 (zh)
CN (2) CN114531405B (zh)
WO (1) WO2022088743A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114915587A (zh) * 2022-05-10 2022-08-16 深圳星云智联科技有限公司 流表老化管理方法及相关设备
CN115134315A (zh) * 2022-09-01 2022-09-30 珠海星云智联科技有限公司 报文转发方法及相关装置
CN115150328A (zh) * 2022-09-07 2022-10-04 珠海星云智联科技有限公司 一种流表硬件卸载方法、设备及介质
CN115622959A (zh) * 2022-11-07 2023-01-17 浪潮电子信息产业股份有限公司 交换机控制方法、装置、设备、存储介质及sdn网络
CN116723162A (zh) * 2023-08-10 2023-09-08 浪潮电子信息产业股份有限公司 一种网络首包处理方法、系统、装置、介质及异构设备
WO2023241573A1 (zh) * 2022-06-17 2023-12-21 华为技术有限公司 流表审计方法、装置、系统及相关设备

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210144094A1 (en) * 2020-11-09 2021-05-13 Namrata Limaye Extension of openvswitch megaflow offloads to hardware to address hardware pipeline limitations
CN117768292A (zh) * 2022-09-24 2024-03-26 华为技术有限公司 逻辑绑定口的管理方法、装置、系统及存储介质
CN115941598B (zh) * 2023-03-09 2023-05-16 珠海星云智联科技有限公司 一种流表半卸载方法、设备及介质
CN117692382A (zh) * 2024-02-04 2024-03-12 珠海星云智联科技有限公司 链路聚合方法、网卡、设备以及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103634225A (zh) * 2013-12-18 2014-03-12 武汉朋客云计算有限公司 云计算网络虚拟化中的业务带宽扩展方法
CN105245456A (zh) * 2015-10-20 2016-01-13 浪潮(北京)电子信息产业有限公司 一种云服务器内卸载sdn虚拟网络功能的方法和系统
US20190052480A1 (en) * 2018-06-29 2019-02-14 Intel Corporation Technologies for hairpinning network traffic
CN109768871A (zh) * 2017-11-09 2019-05-17 阿里巴巴集团控股有限公司 配置多个虚拟网卡的方法、宿主机和存储介质

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100417142C (zh) * 2005-12-22 2008-09-03 华为技术有限公司 将接口流量在多个网络处理器引擎中均担的方法
US8761187B2 (en) * 2011-06-14 2014-06-24 Futurewei Technologies, Inc. System and method for an in-server virtual switch
US8930690B2 (en) * 2012-03-21 2015-01-06 Microsoft Corporation Offloading packet processing for networking device virtualization
CN104219075B (zh) * 2013-05-31 2017-10-24 新华三技术有限公司 一种基于开放流协议的lacp环路检测方法和装置
CN103401797B (zh) * 2013-07-24 2016-05-11 杭州华三通信技术有限公司 一种报文处理方法和设备
CN103532878B (zh) * 2013-09-26 2017-01-04 华为技术有限公司 数据包的处理方法和网络流量的管理方法及装置和系统
US9774502B2 (en) * 2014-06-25 2017-09-26 Ciena Corporation Systems and methods for combined software defined networking and distributed network control
CN105763471B (zh) * 2014-12-16 2019-12-17 中兴通讯股份有限公司 虚拟机环境下链路管理方法、装置和系统
US10812632B2 (en) * 2015-02-09 2020-10-20 Avago Technologies International Sales Pte. Limited Network interface controller with integrated network flow processing
CN105207873B (zh) * 2015-08-31 2019-02-26 华为技术有限公司 一种报文处理方法和装置
EP3525423B1 (en) * 2016-11-09 2021-04-07 Huawei Technologies Co., Ltd. Packet processing method in cloud computing system, host, and system
CN115037575A (zh) * 2017-12-26 2022-09-09 华为技术有限公司 报文处理的方法和装置
CN111163015B (zh) * 2019-12-24 2023-05-09 北京百卓网络技术有限公司 报文发送方法、装置及汇聚分流设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103634225A (zh) * 2013-12-18 2014-03-12 武汉朋客云计算有限公司 云计算网络虚拟化中的业务带宽扩展方法
CN105245456A (zh) * 2015-10-20 2016-01-13 浪潮(北京)电子信息产业有限公司 一种云服务器内卸载sdn虚拟网络功能的方法和系统
CN109768871A (zh) * 2017-11-09 2019-05-17 阿里巴巴集团控股有限公司 配置多个虚拟网卡的方法、宿主机和存储介质
US20190052480A1 (en) * 2018-06-29 2019-02-14 Intel Corporation Technologies for hairpinning network traffic

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4228177A4

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114915587A (zh) * 2022-05-10 2022-08-16 深圳星云智联科技有限公司 流表老化管理方法及相关设备
CN114915587B (zh) * 2022-05-10 2023-12-22 深圳星云智联科技有限公司 流表老化管理方法及相关设备
WO2023241573A1 (zh) * 2022-06-17 2023-12-21 华为技术有限公司 流表审计方法、装置、系统及相关设备
CN115134315A (zh) * 2022-09-01 2022-09-30 珠海星云智联科技有限公司 报文转发方法及相关装置
CN115150328A (zh) * 2022-09-07 2022-10-04 珠海星云智联科技有限公司 一种流表硬件卸载方法、设备及介质
CN115622959A (zh) * 2022-11-07 2023-01-17 浪潮电子信息产业股份有限公司 交换机控制方法、装置、设备、存储介质及sdn网络
CN116723162A (zh) * 2023-08-10 2023-09-08 浪潮电子信息产业股份有限公司 一种网络首包处理方法、系统、装置、介质及异构设备
CN116723162B (zh) * 2023-08-10 2023-11-03 浪潮电子信息产业股份有限公司 一种网络首包处理方法、系统、装置、介质及异构设备

Also Published As

Publication number Publication date
US20230269182A1 (en) 2023-08-24
EP4228177A1 (en) 2023-08-16
CN114531405A (zh) 2022-05-24
CN114531405B (zh) 2023-06-06
EP4228177A4 (en) 2024-04-17
CN116866283A (zh) 2023-10-10

Similar Documents

Publication Publication Date Title
WO2022088743A1 (zh) 一种流表处理方法及相关设备
US10534601B1 (en) In-service software upgrade of virtual router with reduced packet loss
US9942148B1 (en) Tunneled packet aggregation for virtual networks
US11223579B2 (en) Data processing method, network interface card, and server
WO2018023499A1 (zh) 网络接口卡、计算设备以及数据包处理方法
US9021116B2 (en) System and method to create virtual links for end-to-end virtualization
US9448821B2 (en) Method and system for realizing virtual machine mobility
US11323340B2 (en) Packet flow monitoring in software-defined networking (SDN) environments
WO2018023498A1 (zh) 网络接口卡、计算设备以及数据包处理方法
EP3251304A1 (en) Method and apparatus for connecting a gateway router to a set of scalable virtual ip network appliances in overlay networks
US11936562B2 (en) Virtual machine packet processing offload
CN113326228B (zh) 基于远程直接数据存储的报文转发方法、装置及设备
JP2008289146A (ja) ネットワークトラフィックのインテリジェントロードバランシング及びフェイルオーバー
CA2968964A1 (en) Source ip address transparency systems and methods
US20220006734A1 (en) Encapsulated fragmented packet handling
US11336570B1 (en) Layer three multi-homing for virtual networks
JP2008295041A (ja) ネットワークトラフィックのインテリジェントロードバランシング及びフェイルオーバー
US20220255772A1 (en) Packet sending method, apparatus, and system
CN113965521B (zh) 数据包的传输方法、服务器及存储介质
WO2019179161A1 (zh) 一种数据流量处理方法、设备及系统
US10298494B2 (en) Reducing short-packet overhead in computer clusters
US10313926B2 (en) Large receive offload (LRO) processing in virtualized computing environments
WO2015188706A1 (zh) 数据帧的处理方法、装置与系统
CN116743663A (zh) 一种数据包处理方法、装置及存储介质
WO2016079626A1 (en) Reducing short-packet overhead in computer clusters

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021884482

Country of ref document: EP

Effective date: 20230508

NENP Non-entry into the national phase

Ref country code: DE