WO2018023499A1 - 网络接口卡、计算设备以及数据包处理方法 - Google Patents

网络接口卡、计算设备以及数据包处理方法 Download PDF

Info

Publication number
WO2018023499A1
WO2018023499A1 PCT/CN2016/093098 CN2016093098W WO2018023499A1 WO 2018023499 A1 WO2018023499 A1 WO 2018023499A1 CN 2016093098 W CN2016093098 W CN 2016093098W WO 2018023499 A1 WO2018023499 A1 WO 2018023499A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
nic
data
virtual switch
destination
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/093098
Other languages
English (en)
French (fr)
Inventor
吴天议
张忠军
甘涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP16911096.2A priority Critical patent/EP3340064B1/en
Priority to CN201680084595.0A priority patent/CN109074330B/zh
Priority to PCT/CN2016/093098 priority patent/WO2018023499A1/zh
Publication of WO2018023499A1 publication Critical patent/WO2018023499A1/zh
Priority to US15/927,005 priority patent/US10581729B2/en
Anticipated expiration legal-status Critical
Priority to US16/796,028 priority patent/US20200204486A1/en
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/026—Capturing of monitoring data using flow identification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/14—Handling requests for interconnection or transfer
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/20—Arrangements for monitoring or testing data switching networks the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/70—Virtual switches
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • the present invention relates to the field of computer technology, and in particular, to a network interface card (English name: network interface card, abbreviation: NIC), a computing device for processing a data packet, and a data packet respectively executed by the NIC and the computing device.
  • a network interface card English name: network interface card, abbreviation: NIC
  • a computing device for processing a data packet and a data packet respectively executed by the NIC and the computing device.
  • VM virtual machine
  • VS virtual switch
  • SDN software defined networking
  • the hardware resources on each computing device need to support at least running multiple VMs, virtual switches, and virtual machine monitors.
  • the virtual machine monitor is also called virtual machine manager (English name: virtual machine manager) ) or management program (English full name: hypervisor).
  • the hardware resources of each computing device are limited. If the virtual switch that is responsible for the data exchange task occupies too much hardware resources, it is easy to affect the operation of the VM on the computing device and reduce the working efficiency.
  • the present application provides a data packet processing method to improve packet processing efficiency.
  • a first aspect of the present application provides a data packet processing method, the method being applied to a computing device, where the computing device includes a network interface card NIC and a host, the NIC establishes a communication connection with the host, and the host runs a virtual machine VM,
  • the method includes: the NIC receiving a first data packet of a data stream; the NIC according to the The matching information of the first data packet queries the flow table set; if the flow table corresponding to the data flow cannot be matched, the NIC forwards the first data packet to the virtual switch running on the host; wherein the virtual switch receives After the first data packet, the flow table corresponding to the data flow is obtained from the SDN controller, so that the flow table corresponding to the data flow is added to the flow table set.
  • the monitoring module running on the virtual switch or the host After the virtual switch obtains the flow table corresponding to the data flow by using the first data packet, the monitoring module running on the virtual switch or the host stores the flow table corresponding to the data flow into the flow table set.
  • the NIC After receiving a data packet, the NIC queries the flow table set according to the matching information of the data packet. If the flow table corresponding to the data flow of the data packet cannot be obtained, the data packet is the data flow of the data packet. The first data packet, or the data packet is not the first data packet of the data stream, but the flow table corresponding to the data flow in the flow table collection has aged.
  • the data packet processing method the NIC performs a matching action between the flow table and the data packet, improves the processing efficiency of the data packet, and sends the data packet that cannot be matched to the flow table to the virtual switch to obtain the corresponding flow table for The NIC processes the subsequent data packets of the data stream.
  • the virtual switch running on the host is configured with at least one virtual switch port, where each virtual switch port corresponds to a VM running on the host, and the NIC receives the Before the first data packet, the method further includes: the NIC receiving configuration information of the virtual switch port; the NIC configuring at least one NIC port on the NIC according to the configuration information of the virtual switch port, each NIC port passing through a single root
  • the input/output virtualization (English name: single root-input/output virtualization, abbreviation: SR-I/OV) technology is connected to a VM running on the host.
  • the configuration of the virtual switch port and the NIC port can be completed prior to the packet processing method provided by the first aspect, and the configuration information of the virtual switch port can be sent to the NIC by the NIC driver running on the host.
  • the flow table corresponding to the data stream includes routing information of the data packet of the data stream, and the first packet is forwarded to the virtual switch
  • the method further includes: the NIC querying the flow table set according to the matching information of the first data packet, acquiring a flow table corresponding to the data flow, and forwarding the first information according to the routing information of the data flow of the data flow A packet to the destination VM.
  • the routing information of the data packet of the data stream indicates that the destination VM corresponds to NIC port.
  • the NIC After the monitoring module running on the virtual switch or the host stores the flow table corresponding to the data flow in the flow table set, the NIC queries the flow table set according to the matching information of the first data packet, and the flow table set at this time A flow table corresponding to the data stream is already stored in the flow table. After the first data packet is sent to the virtual switch, the NIC may periodically match the first data packet with the flow table in the flow table set, or the flow table corresponding to the data flow is stored in the flow table set. Thereafter, a notification message is sent to the NIC, instructing the NIC to perform a match between the first data packet and the flow table in the flow table set.
  • the implementation does not require the virtual switch to perform matching of the first data packet with the flow table, which reduces the workload of the virtual switch.
  • the flow table corresponding to the data stream includes routing information of the data packet of the data stream, and forwarding the first to the virtual switch
  • the method further includes: receiving, by the NIC, the first data packet returned by the virtual switch, where the returned first data packet includes the port identifier corresponding to the destination VM, where the port identifier is a virtual switch port identifier or a NIC.
  • the port identifier is forwarded by the NIC to the destination VM according to the port identifier, and the port identifier is added by the virtual switch according to the routing information of the data packet of the data stream.
  • the implementation does not need to match the NIC with the first data packet, thereby improving the processing efficiency of the data packet.
  • the virtual switch communicates with the NIC through at least one queue, and each queue corresponds to a VM running on the host; After the virtual switch forwards the first data packet, the method further includes: the NIC receiving the first data packet from a queue corresponding to the destination VM of the first data packet; and the NIC is configured according to the queue information of the queue corresponding to the destination VM. The NIC port corresponding to the destination VM forwards the first data packet to the destination VM.
  • the virtual switch After obtaining the routing information of the data packet of the data stream, the virtual switch stores the first data packet in a queue corresponding to the destination VM according to the routing information of the data packet of the data stream.
  • the NIC receives the first data packet from the queue corresponding to the destination VM, and the NIC driver running on the host sends queue information of the queue corresponding to the destination VM to the NIC, where the queue information is used to notify the NIC that the first data packet is from the NIC.
  • the queue corresponding to the destination VM is obtained, and the NIC forwards the first data packet to the destination VM from the NIC port corresponding to the destination VM according to the corresponding relationship between the pre-stored queue and the NIC port.
  • the implementation does not require matching of the NIC with the first data packet, compared with the foregoing third implementation manner.
  • the NIC does not need to convert the port identifier, which further improves the processing efficiency of the data packet.
  • a NIC for performing the data packet processing method provided by the first aspect of the present application.
  • the NIC includes: a host interface, a network interface, and a processing chip, the network interface is configured to communicate with an external network, and the network interface establishes a communication connection with the processing chip, the host interface is configured to communicate with the host, and the host interface and the processing chip Establishing a communication connection, the host running a VM; the network interface is configured to receive a first data packet of the data stream; the processing chip is configured to query the flow table set according to the matching information of the first data packet, where the data cannot be matched In the case of the flow table corresponding to the flow, the first data packet is forwarded to the virtual switch running on the host through the host interface; wherein, after receiving the first data packet, the virtual switch acquires the data flow from the SDN controller. Corresponding flow table, so that the flow table corresponding to the data flow is added to the flow table set.
  • the NIC can perform the matching action between the flow table and the data packet, improve the processing efficiency of the data packet, and the NIC sends the data packet that cannot be matched to the flow table to the virtual switch, so as to obtain the corresponding flow table for the NIC to the data.
  • the processing of subsequent packets of the stream can perform the matching action between the flow table and the data packet, improve the processing efficiency of the data packet, and the NIC sends the data packet that cannot be matched to the flow table to the virtual switch, so as to obtain the corresponding flow table for the NIC to the data.
  • the virtual switch running on the host is configured with at least one virtual switch port, where each virtual switch port corresponds to a VM running on the host; the processing chip, And configured to receive configuration information of the virtual switch port, and configure at least one NIC port on the NIC according to the configuration information of the virtual switch port, where each NIC port passes a SR-I/OV technology and a VM running on the host connection.
  • the processing chip is further configured to query the flow table set according to the matching information of the first data packet, and obtain the corresponding data stream
  • the flow table, the flow table corresponding to the data flow includes routing information of the data packet of the data flow, and forwards the first data packet to the destination VM according to the routing information of the data packet of the data flow.
  • the virtual switch does not need to match the first data packet, which reduces the workload of the virtual switch.
  • the processing chip is further configured to receive a first data packet returned by the virtual switch, where the returned first data packet includes Corresponding to the port ID of the destination VM, the port identifier is the virtual switch port identifier or NIC port. An identifier, the port identifier is added by the virtual switch according to the routing information of the data packet of the data flow, the flow table corresponding to the data flow includes routing information of the data packet of the data flow, and is further configured to forward the first according to the port identifier A packet to the destination VM.
  • the NIC does not need to match the first data packet with the flow table, thereby improving the processing efficiency of the data packet.
  • the virtual switch communicates with the NIC through at least one queue, and each queue corresponds to a VM running on the host; the processing chip And receiving the second data packet from the queue corresponding to the destination VM of the first data packet, and forwarding the second data packet from the NIC port corresponding to the destination VM according to the queue information of the queue corresponding to the destination VM The purpose of the VM.
  • the NIC does not need to match the first data packet with the flow table, and compared with the foregoing third implementation manner, the NIC does not need to convert the port identifier, thereby further improving the processing efficiency of the data packet. .
  • a third aspect of the present application provides a data packet processing method, where the method is applied to a computing device, where the computing device includes a network interface card NIC and a host, and the NIC establishes a communication connection with the host, and the host runs a virtual machine VM, the method
  • the NIC receives the second data packet of the data stream; the NIC queries the flow table set according to the matching information of the second data packet, and obtains a flow table corresponding to the data flow, where the flow table corresponding to the data flow includes the data flow
  • the routing information of the data packet; the NIC forwards the second data packet to the destination VM according to the routing information of the data packet of the data flow.
  • the packet processing method performs the matching action between the flow table and the data packet by the NIC, thereby improving the processing efficiency of the data packet.
  • the NIC is connected to the VM running on the host by using an SR-I/OV technology; the NIC passes the routing information of the data packet of the data flow, The connection of the NIC to the destination VM forwards the second data packet to the destination VM.
  • At least one virtual switch port is configured on the virtual switch running on the host, and each virtual switch port corresponds to one running on the host VM; before the NIC receives the second data packet of the data stream, the method further includes The NIC receives the configuration information of the virtual switch port; according to the configuration information of the virtual switch port, configure at least one NIC port on the NIC, and each NIC port passes the SR-I/OV technology and one of the hosts running on the host The VM is connected, and the routing information of the data packet of the data stream indicates the NIC port corresponding to the destination VM.
  • the method before the NIC receives the second data packet of the data stream, the method further includes: the NIC receiving the third data of the data stream The NIC queries the flow table set according to the matching information of the third data packet; if the flow table corresponding to the data flow cannot be matched, the NIC forwards the third data packet to the virtual switch running on the host; After receiving the third data packet, the virtual switch acquires a flow table corresponding to the data flow from the SDN controller, so that the flow table corresponding to the data flow is added to the flow table set.
  • the method further includes: the NIC is configured according to the third data packet The matching information queries the flow table set, obtains a flow table corresponding to the data flow, and forwards the third data packet to the destination VM according to the routing information of the data packet of the data flow.
  • the method further includes: receiving, by the NIC, the virtual switch returns a third data packet, where the returned third data packet includes a port identifier corresponding to the destination VM, where the port identifier is a virtual switch port identifier or a NIC port identifier, and the port identifier is determined by the virtual switch according to the data packet of the data stream. Routing information is added; the NIC forwards the third data packet to the destination VM according to the port identifier.
  • the virtual switch communicates with the NIC through at least one queue, and each queue corresponds to a VM running on the host; After the virtual switch forwards the third data packet, the method further includes: receiving, by the NIC, the third data packet from a queue corresponding to the destination VM; the NIC corresponding to the queue information corresponding to the destination VM The NIC port forwards the third data packet to the destination VM.
  • the NIC needs to strip the overlay header corresponding to the third data packet to obtain the third data packet. In this implementation manner, the NIC strips off the overlay type data packet by the NIC. In fact, after receiving the other overlay type data packets of the data stream, the NIC also strips the overlay header to obtain the inner layer data. package.
  • the NIC implements stripping of the overlay header, which reduces the workload of the host.
  • the method before the NIC forwards the second data packet to the destination VM, the method further includes: the NIC The second data packet performs a security group check, and after determining that the security group check of the second data packet passes, performing the step of forwarding the second data packet to the destination VM.
  • the NIC also needs to forward the third data packet after the security group of the third data packet is checked.
  • the security group check of the second data packet by the NIC is exemplarily provided. In fact, before the NIC forwards other data packets of the data flow, the NIC needs to perform security group check.
  • the NIC further implements a security group check on the second data packet, which improves the security of data packet transmission and reception, and further reduces the workload of the host.
  • a fourth aspect of the present application provides a NIC for performing the packet processing method provided by the foregoing third aspect.
  • the NIC includes: a host interface, a network interface, and a processing chip, the network interface is configured to communicate with an external network, and the network interface establishes a communication connection with the processing chip, the host interface is configured to communicate with the host, and the host interface and the processing chip Establishing a communication connection, the host running a VM; the network interface is configured to receive a second data packet of the data stream; the processing chip is configured to query the flow table set according to the matching information of the second data packet, and obtain the corresponding data stream a flow table, the flow table corresponding to the data flow includes routing information of the data packet of the data flow; and forwarding the second data packet to the destination VM according to the routing information of the data packet of the data flow.
  • the NIC is connected to the VM running on the host by using an SR-I/OV technology
  • the processing chip is configured to forward the second data packet to the destination VM by using a connection between the NIC and the destination VM according to routing information of the data packet of the data stream.
  • At least one virtual switch port is configured on the virtual switch running on the host, and each virtual switch port corresponds to one running on the host
  • the processing chip is further configured to receive configuration information of the virtual switch port, and configure at least one NIC port on the NIC according to the configuration information of the virtual switch port, where each NIC port passes the SR-I/OV technology and the host A VM connection running on the router, and the routing information of the data packet of the data stream indicates the NIC port corresponding to the destination VM.
  • the network interface is further configured to receive a third data packet of the data stream, where the processing chip is further configured to The matching information of the three data packets is used to query the flow table set, and if the flow table corresponding to the data flow cannot be matched, the third data packet is forwarded to the virtual switch running on the host; wherein the virtual switch receives the After the third data packet, the flow table corresponding to the data flow is obtained from the SDN controller, so that the flow table corresponding to the data flow is added to the flow table set.
  • the processing chip is further configured to query the flow table set according to the matching information of the third data packet, and obtain the data flow corresponding to The flow table forwards the third data packet to the destination VM according to the routing information of the data packet of the data flow.
  • the processing chip is further configured to receive a third data packet returned by the virtual switch, where the returned third data packet includes Corresponding to the port identifier of the destination VM, the port identifier is a virtual switch port identifier or a NIC port identifier, and the port identifier is added by the virtual switch according to the routing information of the data packet of the data flow; and is further used to forward according to the port identifier The third packet is sent to the destination VM.
  • the virtual switch communicates with the NIC through at least one queue, and each queue corresponds to a VM running on the host; the processing chip And receiving the third data packet from the queue corresponding to the destination VM, and forwarding the third data packet to the destination VM from the NIC port corresponding to the destination VM according to the queue information of the queue corresponding to the destination VM.
  • the network interface is configured to receive an overlay type data packet, where the overlay type data packet includes an overlay header and the a second data packet, the overlay header including a virtual scalable local area network VXLAN header, or a network virtualization NVGRE header using a universal route, or a stateless transmission tunnel STT header; the processing chip for stripping the overlay type data packet overlay Header, get the second packet.
  • the eighth implementation manner of the fourth aspect before the processing chip forwards the second data packet to the destination VM, The data packet performs a security group check, and after determining that the security group check of the second data packet is passed, performing the step of forwarding the second data packet to the destination VM.
  • a fifth aspect of the present application provides a computing device, including a network interface card NIC and a host, the NIC establishing a communication connection with the host, where the virtual machine VM and the virtual switch are running, and the virtual switch is configured with at least a virtual switch port, each virtual switch port corresponding to a VM running on the host; the host is configured to send configuration information of the virtual switch port to the NIC; the NIC is configured to configure information according to the virtual switch port, Configuring at least one NIC port on the NIC, each NIC port is connected to a VM running on the host by using SR-I/OV technology; the NIC is further configured to receive a second data packet of the data stream, according to the second The matching information of the data packet is used to query the flow table set, and the flow table corresponding to the data flow is obtained.
  • the flow table corresponding to the data flow includes routing information of the data packet of the data flow, and the routing information of the data packet of the data flow indicates the destination VM corresponding to the flow table.
  • the NIC port, and the routing information of the data packet according to the data stream, forwards the first data packet to the destination VM.
  • the NIC is further configured to receive a third data packet of the data stream, and query the flow table set according to the matching information of the third data packet, where When the flow table corresponding to the data stream is matched, the third data packet is forwarded to the host; the host is configured to obtain, after receiving the third data packet, a flow table corresponding to the data flow from the SDN controller, So that the flow table corresponding to the data flow is added to the flow table set.
  • the NIC sends the third data packet to a virtual switch running on the host.
  • the NIC is further configured to query the flow table set according to the matching information of the third data packet, and obtain the corresponding data flow Flow The table, and the routing information of the data packet according to the data stream, forwards the third data packet to the destination VM.
  • the NIC After the flow table corresponding to the data flow is added to the flow table set, the NIC queries the flow table set according to the matching information of the third data packet.
  • the host is further configured to generate a returned third data packet, where the returned third data packet includes a destination corresponding to the purpose
  • the port identifier of the VM is a virtual switch port identifier or a NIC port identifier, and the port identifier is added by the host according to the routing information of the data packet of the data stream; the NIC is further configured to receive the returned third data packet. And forwarding the third data packet to the destination VM according to the port identifier.
  • the virtual switch communicates with the NIC through at least one queue, and each queue corresponds to a VM running on the host; the host, The NIC is further configured to receive the third data packet from the queue corresponding to the destination VM, and the queue information corresponding to the queue corresponding to the destination VM, The third data packet is forwarded from the NIC port corresponding to the destination VM to the destination VM.
  • the host After receiving the third data packet sent by the NIC, the host sends the third data packet to a queue corresponding to the destination VM.
  • the NIC is specifically configured to receive an overlay type data packet, where the overlay type data packet includes an overlay header and the a second data packet, the overlay header including a virtual scalable local area network VXLAN header, or a network virtualization NVGRE header using a universal route, or a stateless transmission tunnel STT header, and an overlay header stripping the overlay type data packet to obtain the first data packet Two packets.
  • the NIC before the NIC forwards the second data packet to the destination VM, the NIC is further configured to use the second data packet Performing a security group check, after determining that the security group check of the second data packet is passed, performing the step of forwarding the second data packet to the destination VM.
  • a sixth aspect of the present application provides a packet processing method, which is applied to the computing device provided by the aforementioned fifth aspect.
  • the method includes: the host sends configuration information of the virtual switch port to the NIC; the NIC configures at least one NIC port on the NIC according to the configuration information of the virtual switch port, Each NIC port is connected to a VM running on the host by using SR-I/OV technology; the NIC receives the second data packet of the data stream, queries the flow table set according to the matching information of the second data packet, and obtains the data flow.
  • the flow table corresponding to the data flow includes routing information of the data packet of the data flow, the routing information of the data packet of the data flow indicates the NIC port corresponding to the destination VM, and the routing of the data packet according to the data flow Information, forwarding the second data packet to the destination VM.
  • the method further includes: receiving, by the NIC, a third data packet of the data stream, and querying the flow table set according to the matching information of the third data packet, where If the flow table corresponding to the data flow cannot be matched, the third data packet is forwarded to the host; after receiving the third data packet, the host obtains the flow table corresponding to the data flow from the SDN controller, so as to facilitate A flow table corresponding to the data flow is added to the flow table set.
  • the method further includes: the NIC according to the first The matching information of the three data packets queries the flow table set, obtains the flow table corresponding to the data flow, and forwards the third data packet to the destination VM according to the routing information of the data packet of the data flow.
  • the method further includes: the host generating the returned third data a packet, the returned third data packet includes a port identifier corresponding to the destination VM, where the port identifier is a virtual switch port identifier or a NIC port identifier, and the port identifier is added by the host according to routing information of the data packet of the data stream.
  • the NIC receives the returned third data packet and forwards the third data packet to the destination VM according to the port identifier.
  • the virtual switch communicates with the NIC through at least one queue, and each queue corresponds to a VM running on the host; After forwarding the third data packet to the host, the method further includes: the host sending the third data packet to a queue corresponding to the destination VM; the NIC receiving the third data packet from a queue corresponding to the destination VM, and The third data packet is forwarded from the NIC port corresponding to the destination VM to the destination VM according to the queue information of the queue corresponding to the destination VM.
  • the receiving, by the NIC, the second data packet includes: the NIC receiving an overlay type data packet,
  • the overlay type data packet includes an overlay header and the second data packet,
  • the overlay header includes a virtual scalable local area network VXLAN header, or a network virtualization NVGRE header using a universal route, or a stateless transmission tunnel STT header, and stripping the overlay
  • the overlay header of the type packet acquires the second packet.
  • the method before the NIC forwards the second data packet to the destination VM, the method includes: the NIC The second data packet performs a security group check, and after determining that the security group check of the second data packet is passed, performing the step of forwarding the second data packet to the destination VM.
  • a seventh aspect of the present application provides a configuration method, where the configuration method is applied to a host, and the host establishes a communication connection with the NIC, where the host runs a VM, a virtual switch, and an NIC driver, and the virtual switch running on the host is configured at least A virtual switch port, each virtual switch port corresponding to a VM running on the host, the method comprising: the NIC driver sending configuration information of the virtual switch port to the NIC, where configuration information of the virtual switch port is indicated on the NIC Configure at least one NIC port, each NIC port connected to a VM running on the host through SR-I/OV technology.
  • the eighth aspect of the present application provides a data packet processing method, which is applied to a host that executes the configuration method provided by the seventh aspect of the present application, and the host performs the data packet processing method provided by the fifth aspect of the present application.
  • the method includes: receiving, by the virtual switch running on the host, a third data packet of the data flow; the virtual switch acquiring a flow table corresponding to the data flow from the SDN controller; the virtual switch or the monitoring module running by the host is the data flow The corresponding flow table is added to the flow table collection.
  • the method further includes: the virtual switch sending a notification message to the NIC, where The notification message is used to notify the NIC that the flow table corresponding to the data flow has been added to the flow table set, so that the NIC processes the third data packet according to the flow table corresponding to the data flow in the flow table set.
  • the flow table corresponding to the data stream includes routing information of the data packet of the data stream
  • the method further includes: the data packet of the virtual switch according to the data stream Routing information generates a returned third data packet, and sends the returned third data packet to the The NIC, the returned third data packet includes a port identifier corresponding to the destination VM, where the port identifier is a virtual switch port identifier or a NIC port identifier, so that the NIC forwards the third data packet according to the port identifier to the destination.
  • VM virtual switch port identifier or a NIC port identifier
  • the virtual switch communicates with the NIC through at least one queue, and each queue corresponds to a VM running on the host; the method further includes: the virtual switch The third data packet is sent to the queue corresponding to the destination VM; the NIC drives the queue information of the queue corresponding to the destination VM to the NIC, so that the NIC according to the queue information of the queue corresponding to the destination VM, from the purpose The NIC port corresponding to the VM forwards the third data packet to the destination VM.
  • a ninth aspect of the present application provides a host including a processor, a memory, and a bus, wherein the processor and the memory establish a communication connection through the bus, and when the processor is running, perform the configuration method provided in the foregoing seventh aspect.
  • a tenth aspect of the present application provides a host including a processor, a memory, and a bus, wherein the processor and the memory establish a communication connection through the bus, and when the processor is running, performing the foregoing eighth or eighth aspect A packet processing method provided by any of the implementations.
  • a storage medium in which program code is stored, and when the program code is executed by the computing device, the configuration method provided by the seventh aspect is executed.
  • the storage medium includes, but is not limited to, a flash memory, a hard disk (English: hard disk drive, HDD), or a solid state drive (English: solid state drive, abbreviated as SSD).
  • a twelfth aspect of the present application provides a storage medium storing program code, when the program code is executed by the computing device, executing data provided by any one of the eighth aspect or the eighth aspect Packet processing method.
  • the storage medium includes, but is not limited to, a flash memory, an HDD, or an SSD.
  • a thirteenth aspect of the present application provides a computer program product, which may be a software installation package, when the software installation package is executed by the computing device, performing the seventh aspect Configuration method.
  • a computer program product which may be a software installation package, and when the software installation package is executed by the computing device, performing any one of the eighth aspect or the eighth aspect The method of packet processing provided by the method.
  • FIG. 1 is a schematic diagram of a data center architecture in the prior art
  • FIG. 2a is a schematic diagram of an SDN architecture provided by an embodiment of the present application.
  • 2b is a schematic structural diagram of a computing device in an SDN in the prior art
  • 2c is a schematic structural diagram of a computing device provided by an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of another computing device according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic flowchart of a data packet processing method according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of another computing device according to an embodiment of the present disclosure.
  • FIG. 5b is a schematic structural diagram of another computing device according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of another computing device according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of another computing device according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of an NIC according to an embodiment of the present application.
  • FIG. 6b is a schematic structural diagram of another NIC according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of another NIC according to an embodiment of the present application.
  • first, second, third, etc. are used in the present application to distinguish each object, such as a first data packet, a second data packet, a third data packet, etc., but each "first”, “second”, “first” There is no logical or temporal dependency between the three.
  • the data packet consists of matching information and payload (English full name: payload).
  • the matching information is used to match the matching domain of the flow table.
  • a flow table (English name: flow table) is used to control a data flow in an SDN, and may also be referred to as an SDN flow table.
  • a flow table conforming to the OpenFlow protocol or a flow table conforming to other protocols may be used.
  • the flow table includes at least a matching domain and an execution domain for matching with a data packet, the execution domain is used to indicate an action that the data packet matching the upstream table should perform.
  • the execution domain includes the action identifier of the data packet, such as forwarding, discarding, and sending the SDN controller.
  • the execution domain also includes routing information of the data packet, such as the destination port identifier of the data packet.
  • the data stream (English data: data flow) indicates a series of data packets that can match the same flow table. Specifically, the matching information of the data packet in the same data stream can match the matching domain of the flow table corresponding to the data flow.
  • a virtual switch is a switching device implemented by a software installed on a computing device and is commonly used in SDN.
  • Common virtual switches include Open vSwitch, abbreviated OVS, which is a virtual switch for an open source project.
  • the overlay type data packet refers to a data packet processed by the overlay encapsulation technology.
  • the specific overlay encapsulation technology includes a virtual extensible local area network (VXLAN) technology, which uses universal routing. Network virtualization using generic routing encapsulation (abbreviation: NVGRE) technology and stateless transport tunneling (English name: stateless transport tunneling, abbreviation: STT) technology.
  • the Overlay type data packet includes two parts, an overlay header and an original data packet, and the original data packet refers to a data packet sent by the VM or a data packet sent to the VM through a port of the virtual switch, and the overlay header is superimposed on the original data packet. To transmit the overlay type data packet in the overlay network. Different overlay packaging techniques correspond to different overlay headers.
  • the application includes two sets of flow tables, that is, a virtual switch accessible flow table set and a NIC accessible flow table set.
  • the virtual switch can access the flow table in the flow table set for use by the virtual switch
  • the NIC can access the flow table in the flow table set for use by the NIC.
  • the virtual switch accessible flow table set is generally stored in the computing device.
  • the NIC-accessible flow table set may be stored in a storage device of the computing device, or may be stored in a storage device inside the NIC.
  • the computing device separately opens a virtual switch accessible flow table set and a NIC accessible flow table set in its storage device. Memory space.
  • the NIC-accessible flow table set is stored in the storage device of the computing device as an example. Those skilled in the art can directly derive the case that the NIC-accessible flow table set is stored in the NIC.
  • an exemplary SR-IOV NIC is directly connected to the VM, and other technologies that support direct connection between the NIC and the VM may be used in actual use.
  • FIG. 2a is a schematic diagram of an SDN architecture applied in the embodiment of the present application.
  • the centralized SDN controller is schematically used in FIG. 2a.
  • the SDN controller may also be distributed to each computing device in a distributed manner.
  • the hardware layers on each computing device are provided with NICs, processors, and storage devices.
  • the processor may be a central processing unit (English: central processing unit, abbreviated: CPU)
  • the storage device includes a volatile memory (English: volatile memory), such as random access memory (English: random-access memory, abbreviation: RAM), and non-volatile memory (English: non-volatile memory), such as read-only memory (English: read-only memory, abbreviation: ROM), flash memory, HDD or SSD.
  • Each host runs with its hardware layer supporting virtual switches within the software layer and the operation of multiple VMs.
  • the host and the NIC in each computing device establish a communication connection, and the host communicates with the external network through the NIC.
  • the NIC first obtains the VM data packet sent to the host from the external network, and then sends the VM packet to the host, and then sends the VM packet to the host. Packets sent by the VM running on the host to the external network are first sent to the NIC and then sent to the external network through the NIC.
  • the following takes the computing device 1 as an example to show the difference between the packet processing flow in the prior art and the data packet processing flow provided by the present application.
  • the NIC in the computing device 1 receives the data packet from the external network, if it is determined that the destination of the data packet belongs to the computing device 1, the data packet is sent to the virtual switch, and then the virtual switch is used. The data packet is matched with the flow table in the virtual switch accessible flow table set, and the data packet is sent to the destination VM connected to the virtual switch according to the indication of the matching flow table.
  • the data packet is The main operating pressures in the process are concentrated on the virtual switch, and the operation of the virtual switch depends on the resources of the hardware layer on the computing device.
  • the data packet is The NIC can access the flow table in the flow table set for matching, and send the data packet to the destination VM connected to the NIC according to the indication of the matching flow table.
  • the flow table in the NIC accessible flow table set is derived from the host, and if the NIC cannot match the data packet in the NIC accessible flow table set, the NIC sends the data packet to the virtual switch, and the virtual switch sends the SDN to the SDN.
  • the controller requests to obtain the flow table corresponding to the data packet, and sends the obtained flow table corresponding to the data packet to the NIC accessible flow table set for use by the NIC in the subsequent data packet processing.
  • VMs on the computing device 1 in FIG. 2c are connected to the NIC.
  • VMs on the computing device 1 in FIG. 2c are connected to the NIC.
  • only some VMs may be connected to the NIC, and other VMs are connected to the virtual switch, and the specific VMs are configured. It is not limited to having to be all connected to the NIC.
  • the computing device in FIG. 2a and FIG. 2c can be implemented by the computing device 200 shown in FIG. 3, and its organizational structure is shown in FIG. 3.
  • the computing device 200 includes a host and a NIC 206.
  • the NIC 206 processes the host through the host bus 208.
  • the device 202 and the memory 204 establish a communication connection, and the NIC 206, the processor 202, and the memory 204 can also communicate by other means such as wireless transmission.
  • Computing device 200 communicates with an external network via NIC 206.
  • the host runs at least one VM and a virtual switch, and the program code for implementing the method on the host side in the packet processing method provided in FIG. 4 is saved in the storage device 204 and executed by the processor 202.
  • the NIC 206 performs the method on the NIC side in the packet processing method provided in FIG.
  • the present application further provides a data packet processing method, where the computing device in the foregoing SDN architecture executes the method during operation, and a schematic flowchart thereof is shown in FIG. 4 .
  • Step 402 The host of the computing device receives the configuration information of the first virtual switch port, where the configuration information of the first virtual switch port indicates that at least one virtual switch port is established on the virtual switch, and each virtual switch port corresponds to one running on the host VM.
  • Step 404 The host generates configuration information of the second virtual switch port, and sends configuration information of the second virtual switch port to the NIC of the computing device.
  • the intercepting module running on the host acquires configuration information of the first virtual switch port, and sends configuration information of the first virtual switch port to a NIC driver running on the host, where the NIC driver is configured according to the first virtual
  • the configuration information of the switch port generates configuration information of the second virtual switch port and sends the configuration information to the NIC.
  • the configuration information of the first virtual switch port is similar to the configuration information of the second virtual switch port, and the NIC driver converts the switch to the NIC drive and NIC communication specifications.
  • Step 406 The NIC configures at least one NIC port on the NIC according to the configuration information of the second virtual switch port, and each NIC port is connected to a VM running on the host by using SR-I/OV technology.
  • the NIC port can be a port of a virtual function (English name: virtual function, abbreviated as VF) defined by the SR-I/OV technology.
  • VF virtual function
  • Steps 402 to 406 are optional steps, and steps 402 to 406 are the configuration process of the virtual switch and the NIC. Steps 402 to 406 are performed once before each step 408 and subsequent steps of step 408 are performed.
  • the VM running on the host is connected to the NIC through the NIC port. Although the VS port corresponding to the VM is established on the virtual switch, the VM running on the host does not. Connect to the virtual switch.
  • the VS port Since the VS port is in one-to-one correspondence with the VM, and the VM and the NIC port are in one-to-one correspondence, the VS port has a one-to-one correspondence with the NIC port.
  • the corresponding relationship between the VS port and the NIC port is stored in the virtual switch, or the corresponding relationship between the VS port and the NIC port is stored in the NIC.
  • At least one of the virtual switch needs to be configured to communicate with the NIC.
  • the virtual switch communicates with the NIC through a queue.
  • the virtual switch sends all the packets destined for the NIC to the queue.
  • the second is shown in Figure 5c.
  • the virtual switch communicates with the NIC through n queues, n is the number of VMs running on the host, and each queue corresponds to one VM.
  • the configuration process does not require the perception of the upper management device.
  • the computing device connects the VM that should be connected to the virtual switch to the NIC.
  • the upper management device does not need to modify the configuration information, which improves the compatibility of the configuration process and reduces the difficulty of implementation. .
  • Step 408 The NIC receives a first overlay type data packet, where the first overlay type data packet includes a first overlay header and the first data packet, and the first overlay header includes a VXLAN header, or an NVGRE header, or an STT header.
  • the first overlay type data packet can be sent to the NIC for the external network.
  • Step 410 The NIC strips the first overlay header of the first overlay type data packet to obtain the first data packet.
  • the action of stripping the overlay header by the host, and the NIC stripping the overlay header reduces the workload of the host.
  • step 410 is not required.
  • Step 412 The NIC queries the NIC accessible flow table set according to the matching information of the first data packet. If the NIC can not access any of the flow table sets, step 414, step 416, step 4181, or step 4182 to step 4184, or step 4185 to step 4186. If the matching NIC can access the flow table in the flow table set, step 420 is performed.
  • the first data packet is the first data packet of the data flow in which the first data packet is located, or the first data packet.
  • the packet is not the first packet of the data stream, but the flow table corresponding to the data stream has been deleted in the NIC accessible flow table set.
  • the NIC can access the flow table corresponding to the data flow in which the first data packet is already stored in the flow table set.
  • Step 414 The NIC forwards the first data packet to the virtual switch by using a host port.
  • the host port can be a port of the physical function defined by the SR-I/OV technology (English name: physical function, abbreviation: PF).
  • Step 416 After receiving the first data packet, the virtual switch acquires a flow table corresponding to the data flow, and the flow table corresponding to the data flow is added to the NIC accessible flow table set.
  • the virtual switch After acquiring the first data packet, the virtual switch sends the first data packet to the SDN controller, and receives a flow table corresponding to the data flow generated by the SDN controller according to the first data packet.
  • the virtual switch may access the flow table set, and may also store information required to generate the flow table corresponding to the data flow, for example, a slow table (English name: slow table), and the virtual switch generates corresponding data streams according to the information.
  • the flow table can be used without sending the first data packet to the SDN controller.
  • the virtual switch stores the flow table corresponding to the data flow into the virtual switch accessible flow table set and the NIC accessible flow table set.
  • the monitoring module running on the host monitors the virtual switch to obtain a flow table corresponding to the data flow, and the monitoring module stores the flow table corresponding to the data flow into the NIC accessible flow table set.
  • the routing information of the data packet of the data stream may specifically include a VS port identifier, and the VS port is in one-to-one correspondence with the VM, and the VM and the NIC port are in one-to-one correspondence, so the VS port and the NIC port are in one-to-one correspondence, and the data of the data stream is The routing information of the packet indicates the NIC port of the destination VM.
  • step 416 the first data packet is sent to its destination VM.
  • Step 4181 The NIC queries the NIC-accessible flow table set according to the matching information of the first data packet, obtains a flow table corresponding to the data flow, and forwards the first data packet according to the routing information of the data packet of the data flow to The purpose of the VM.
  • the NIC needs to have a corresponding relationship between the VS port identifier and the NIC port identifier. After the NIC obtains the VS port identifier included in the routing information of the data packet of the data stream, the VS port identifier is converted into the NIC port identifier. And sending the first data packet from the corresponding NIC port of the NIC port identifier.
  • the virtual switch or the monitoring module stores the flow table corresponding to the data flow to the NIC.
  • a notification message is sent to the NIC, and the notification message is used to notify the NIC that the flow table corresponding to the data flow has been stored in the NIC accessible flow table set.
  • the NIC can match the flow table corresponding to the data flow in the NIC accessible flow table set according to the matching information of the first data packet.
  • the NIC periodically matches the flow table of the NIC-accessible flow table set according to the matching information of the first data packet.
  • the NIC is configured according to the NIC.
  • the matching information of the first data packet may match the flow table corresponding to the data flow in the NIC accessible flow table set.
  • the optional step 4181 does not require the virtual switch to match the first data packet with the flow table corresponding to the data flow, thereby reducing the workload of the virtual switch.
  • Step 4182 The virtual switch matches the first data packet with a flow table corresponding to the data flow in the virtual switch accessible flow table set, and obtains routing information of the data packet of the data flow.
  • Step 4183 the virtual switch generates a returned first data packet according to the routing information of the data packet of the data flow, and sends the returned first data packet to the NIC, where the returned first data packet includes the corresponding data packet.
  • the port ID is the virtual switch port ID or NIC port ID.
  • Step 4184 the NIC receives the returned first data packet, and forwards the second data packet to the destination VM according to the port identifier.
  • the routing information of the data packet of the data stream may specifically include a VS port identifier.
  • the destination VM of the first data packet is VM-1
  • the corresponding port of VM-1 on the virtual switch is VS port 1
  • the corresponding port of VM-1 on the NIC is NIC port 1
  • the data of the data stream is The routing information of the packet includes VS port 1.
  • the returned first data packet generated by the virtual switch includes the port identifier of the destination VM of the first data packet and the first data packet
  • the port identifier of the destination VM of the first data packet is VS port 1 or NIC port 1.
  • the virtual switch adds the routing information of the data packet to the returned first data packet, and the port identifier of the destination VM is VS port 1, and is sent to the NIC through the queue. .
  • the NIC needs to have a corresponding relationship between the VS port identifier and the NIC port identifier.
  • the NIC converts the VS port 1 to the NIC port 1, and the A packet is sent to VM-1 through NIC port 1.
  • the virtual switch has a lower load, which improves the working efficiency of the host.
  • step 4183 after obtaining the routing information of the data packet of the data stream, the virtual switch converts the VS port 1 included in the routing information of the data packet into the NIC port 1, and adds the NIC port 1
  • the port identifier of the destination VM is NIC port 1
  • the returned first data packet is sent to the NIC through the queue.
  • the virtual switch needs to have a corresponding relationship between the VS port identifier and the NIC port identifier.
  • the NIC After receiving the returned first data packet, the NIC sends the first data packet to the VM-1 through the NIC port 1. In this implementation mode, the NIC does not need to convert the port identifier, and the data packet can be processed more efficiently.
  • Step 4185 the virtual switch sends the first data packet to a queue corresponding to the destination VM.
  • the virtual switch communicates with the NIC through at least one queue, and the VM running on each host corresponds to one queue.
  • Step 4186 the NIC receives the first data packet from the queue corresponding to the destination VM, and the NIC forwards the first data packet to the destination from the NIC port corresponding to the destination VM according to the queue information of the queue corresponding to the destination VM. VM.
  • the virtual switch communicates with the NIC through at least n queues, where n is the number of VMs running on the host, and each queue corresponds to one VM.
  • the virtual switch matches the first data packet with the flow table corresponding to the data flow in the virtual switch accessible flow table set, and obtains the routing information of the data packet of the data flow, for example, VS port 1, and VS If port 1 corresponds to VM1 and VM1 corresponds to queue 1, the virtual machine switch sends the first data packet to queue 1.
  • the NIC obtains the first data packet from the queue 1, and the NIC driver running on the host sends queue information to the NIC, where the queue information is used to notify the NIC that the first data packet is from the queue 1. Since the queue 1 corresponds to VM1 and VM1 corresponds to NIC port 1, the NIC sends the first data packet to VM1 through NIC port 1. In this way, the NIC is required to store the correspondence between the queue and the NIC port. Compared with the foregoing two alternatives, the virtual switch and the NIC do not need to convert the routing information of the data packet into the NIC port identifier, thereby improving the forwarding efficiency of the data packet.
  • the VM In the actual SDN, the VM generally has a security group. Therefore, after confirming the destination VM of the first data packet in the three alternatives, optionally, it is also necessary to confirm that the first data packet passes the security group check. , The first data packet is sent to the destination VM of the first data packet.
  • a static security group first determine whether the destination VM of the first data packet belongs to a static security group, and if it is determined that the destination VM of the first data packet belongs to a static security group, determine the first Whether a data packet can match any rule of the static security group. If the first data packet can match at least one rule of the static security group, the first data packet is checked by the static security group. If the destination VM of the first data packet does not belong to any static security group, the static data group check is not performed on the first data packet, and the first data packet is directly processed according to the first preset rule, for example, The first data packet is sent to the destination VM of the first data packet.
  • the first data packet cannot pass the security group check, according to the second preset.
  • the rule processes the first data packet, for example, discarding the first data packet.
  • a static security group with a whitelist is set. If a static security group is configured as a blacklist, the first data packet belongs to a static security group but cannot match the static security group. Any of the rules, the first packet is checked by the static security group. If the destination VM of the first data packet belongs to a static security group, and the first data packet can match at least one rule of the static security group, the first data packet cannot be checked by the static security group.
  • a dynamic security group first determining whether the destination VM of the first data packet belongs to a dynamic security group, and if the destination VM belongs to the dynamic security group, querying the connection tracking table according to the first data packet.
  • Full name: connection track table confirm which connection the first data packet belongs to, and determine the state of the connection of the first data packet and the processing action corresponding to the first data packet, if the processing action of the first data packet indicates forwarding
  • the first data packet is sent to the destination VM of the first data packet, and the first data packet is checked by the dynamic security group.
  • step 416 after step 4182 to step 4184 or step 4185 to step 4186, the security group check can be implemented by the security group module running on the host, so if the security group module confirms that the first data packet cannot pass the security group check, The first data packet need not be sent to the NIC, which improves the working efficiency of the NIC.
  • step 418 is followed by step 4181, the security group check for the data packet sent to the virtual switch can be sent in the data packet. After returning to the NIC, it is executed by the NIC.
  • Step 420 The NIC forwards the first data packet to the destination VM of the first data packet according to the routing information included in the matching flow table.
  • the NIC matches, according to the matching information of the first data packet, a flow table corresponding to the data flow in which the first data packet is located in the NIC accessible flow table set, and according to the data packet route of the data flow included in the flow table.
  • the information forwards the first data packet to the destination VM of the first data packet.
  • the NIC Since in step 412, the NIC is able to match the first data packet to the flow table in the NIC-accessible flow table set, so the first data packet is not the first data packet of the data flow.
  • the NIC refers to the foregoing security group check process according to the routing information included in the matching flow table.
  • the NIC confirms that the first data packet passes the security group check before the first data is used.
  • the packet is sent to the destination VM of the first packet.
  • the second overlay data packet includes the second data packet and the second data.
  • the second overlay header corresponding to the packet if the flow table corresponding to the data stream is still stored in the NIC accessible flow table set, the NIC forwards the second data packet to the destination VM according to the routing information of the data packet of the data flow.
  • step 416 since the flow table in the NIC accessible flow table set may be updated over time, although in step 416 the flow table corresponding to the data flow is added to the NIC accessible flow table set, the NIC is based on the second The matching information of the data packet cannot match any of the flow table of the NIC-accessible flow table set. In this case, step 414, step 416, step 4181 or step 4182 to step 4184 or step 4185 to step 4186 are performed on the subsequent data packet.
  • the data packet processing method offloads the matching function of the data packet and the flow table to the NIC, thereby reducing the workload of the virtual switch, so that the hardware layer resources of the host can better serve the VM, thereby improving the working efficiency of the computing device. .
  • FIG. 5d a schematic structural diagram of another computing device provided by the present application is different from FIG. 5a, FIG. 5b or FIG. 5c.
  • VM-1 to VM-n are connected to the NIC
  • -n+m is connected to the virtual switch.
  • VM-n+1 to VM-n+m may have been configured before performing the configuration process of the virtual switch and the NIC in FIG. 4, or in the configuration process of the virtual switch and the NIC of FIG.
  • VM-n+1 to VM-n+m are connected to the virtual switch
  • VM-1 to VM-n are connected to the NIC.
  • part of the VM-1 to VM-n+m can be configured according to the load condition of the host or according to the information carried in the configuration information received by the host.
  • the VM is connected to the NIC, and the remaining VMs are connected to the virtual switch.
  • the NIC receives the data packet sent by the external network, if the destination VM of the data packet is connected to the NIC, the data packet processing method in FIG. 4 is performed on the data packet, if The destination VM of the packet is connected to the virtual switch, and the NIC directly sends the packet to the virtual switch.
  • the flow table matching of the data packet is completed by the virtual switch, and the data packet is sent to its destination VM.
  • the NIC can implement the foregoing functions by setting a flow table.
  • the NIC cannot receive the data packet of the destination VM connected to the virtual switch. If the upstream table is matched in the NIC-accessible flow table set, the data packet is sent to the virtual switch; or the flow table corresponding to the data flow in which the destination VM is connected to the data packet of the virtual switch is modified, and then the flow table is The NIC can access the flow table set, and the modification of the flow table includes modifying the routing information of the flow table to a host port, and the NIC can access the flow when receiving the data packet of the destination VM connected to the virtual switch. A flow table on the match in the table set indicates that the packet is sent to the virtual switch through the host port.
  • the present application also provides a NIC 600 that can be a NIC provided in any of the preceding figures.
  • the organization structure of the NIC 600 is as shown in FIG. 6a, and includes a host interface 602, a network interface 604, and a processing chip 606.
  • Network interface 604 is used to communicate with an external network and network interface 604 establishes a communication connection with processing chip 606.
  • the host interface 602 is used to communicate with a virtual switch, VM, NIC driver, etc. running on a host to which the NIC 600 is connected, and the host interface 602 establishes a communication connection with the processing chip 606.
  • the NIC port and the host port established on the NIC are virtual ports, and the host port and the NIC port actually communicate with the host through the host interface 602.
  • host interface 602 may actually be the interface of the NIC 600 to the bus connection of the computing device.
  • the host interface 602 is configured to obtain configuration information of the virtual switch port from the host connected to the NIC.
  • the configuration information of the virtual switch port is sent to the processing chip 606.
  • the processing chip 606 is configured to connect the NIC 600 to the VM running on the host according to the configuration information of the virtual switch port.
  • the processing chip 606 configures at least one NIC port on the NIC according to the configuration information of the virtual switch port, and each NIC port corresponds to a VM running on the host.
  • the above is the function of each unit in the NIC 600 during the configuration process of the NIC 600.
  • the NIC 600 can also be used for processing the data packet, refer to step 408 in the foregoing packet processing method and the steps subsequent to step 408.
  • the network interface 604 is further configured to receive the first overlay type data packet, and refer to step 408.
  • the network interface 604 sends the received first overlay type data packet to the processing chip 606.
  • the processing chip 606 is further configured to: after receiving the first overlay type data packet, refer to the foregoing step 410 and step 412 for processing the first overlay type data packet.
  • the processing chip 606 is further configured to perform step 412. In step 412, if it is determined that the first data packet cannot match any of the flow table in the NIC-accessible flow table set, step 414 and subsequent steps are performed. In step 412, it is determined that the first data packet can match the flow table in the NIC-accessible flow table set, and step 420 is performed.
  • the processing chip 606 performs any one of three alternatives, which respectively correspond to the part executed in the foregoing step 4181, the step 4182 to the step 4184, and the NIC side in the step 4185 to the step 4186.
  • the processing chip 606 queries the NIC-accessible flow table set according to the matching information of the first data packet, and obtains a flow table corresponding to the data flow in which the first data packet is located, that is, obtains the
  • the routing information of the data packet includes the VS port identifier, which converts the VS port identifier into a NIC port identifier.
  • Option 2 corresponds to the part executed by the NIC side in the foregoing steps 4182 to 4184.
  • the processing chip 606 receives the returned first data packet, and the processing chip 606 obtains the NIC port identifier according to the port identifier carried in the returned first data packet. If the port is identified as a virtual switch port identification, processing chip 606 converts the virtual switch port identification to a NIC port identification. This port ID may also be the NIC port ID.
  • Option 3 corresponds to the portion of the foregoing step 4185 to step 4186 where the NIC side performs.
  • the processing chip 606 receives the first data packet from one of the n queues. Since the processing chip 606 is pre-configured with the correspondence between each queue and the NIC port, the processing chip 606 can obtain the queue corresponding to the first data packet. NIC port ID.
  • the processing chip 606 performs step 412 and determines that the first data packet can match the flow table in the NIC-accessible flow table set, and obtains routing information of the data packet of the data flow included in the matching flow table.
  • the routing information of the data packet of the data stream may include a VS port identifier, and the processing chip 606 converts the VS port identifier into a NIC port identifier.
  • the processing chip 606 After the processing chip 606 performs the step 412, the NIC port identifier corresponding to the first data packet is obtained, whether the first data packet can match the flow table in the NIC accessible flow table set. A destination VM corresponding to the data stream in which the first data packet is located. After the processing chip 606 determines the destination VM of the first data packet, it also performs a security group check on the first data packet. The processing chip 606, after determining the security group check of the first data packet, passes the first data packet to the destination VM through the host interface 602. The specific processing chip 606 performs a security group check process on the first data packet, and refers to the foregoing data packet processing method.
  • the processing chip 606 does not need to perform step 410.
  • the NIC provided above implements the flow table matching function, and the data packets in the NIC-accessible flow table set are not sent to the virtual switch for processing, thereby reducing the load on the host and improving the working efficiency of the host connected to the NIC. .
  • the processing chip 606 can be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (abbreviated as PLD).
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above PLD may be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), a field programmable gate array (English: field programmable gate array, abbreviated: FPGA), general array logic (English: general array logic, Abbreviation: GAL) or any combination thereof.
  • the processing chip 606 may include an overlay chip 6062, a flow table matching chip 6064, and a security group check chip 6066.
  • the overlay chip 6062 is used for the overlay header stripping of the overlay type data packet sent by the network interface 804 to the processing chip 606.
  • the flow table matching chip 6064 is configured to match the data packet stripped of the overlay header with the flow table stored in the NIC-accessible flow table set.
  • the security group check chip 6066 is configured to determine whether the data packet matching the upstream table in the flow table matching chip 8064 passes through the security The entire group is checked and the packets checked by the security group are sent to the destination VM through the host interface 602.
  • the Overlay chip 6062 and the security group check chip 6066 are optional components.
  • the processing chip 606 can also be implemented by a processor, a storage device, and a logic chip, which can be implemented by a PLD or an ASIC.
  • the processor and the logic chip each perform a part of functions, and the functions of the two can be allocated in various ways.
  • the logic chip is used to strip the overlay header of the overlay type data packet sent by the network interface 604 to the processing chip 606.
  • the processor in the processing chip 606 is working, reading the code in the memory for reading the flow table in the NIC accessible flow table set, and sending the flow table in the NIC accessible flow table set to the logic chip
  • the logic chip matches the data packet of the overlay header with the flow table.
  • the processor is also used to read the information required for the security group check and send the information required for the security group check to the logic chip for the logic chip to perform a security group check on the data packet.
  • the logic chip may also be composed of an overlay chip, a flow table matching chip, and a security group check chip.
  • the overlay sub-chip and the security group check sub-chip are optional components.
  • the overlay sub-chip is used to strip the overlay header of the overlay type packet.
  • the processor in the processing chip 606 of the NIC 600 shown in FIG. 6c is configured to acquire information required for flow table matching or security group checking and send information required for flow table matching or security group checking to the logic chip, and the flow table matching sub- The chip completes the flow table matching of the data packet according to the information required by the flow table matching, and the security group checks the sub-chip to complete the security group check of the data packet according to the information required by the security group check.
  • the present application also provides a data packet processing method, which is executed by the NIC in any of the foregoing figures.
  • the method refers specifically to the portion of the packet processing method corresponding to FIG. 4 that is executed on the NIC side.
  • the present application also provides a configuration method in which the host in any of the preceding figures executes the method.
  • the method refers specifically to step 402 and step 404 in the packet processing method corresponding to FIG. 4.
  • the present application also provides a data packet processing method, which is executed when the host is running in any of the foregoing figures.
  • the method refers specifically to the method performed by the host side after step 408 in the packet processing method corresponding to FIG. 4 .
  • the flow table corresponding to the data stream is stored in a part of the NIC accessible flow table set, and then the notification message is sent to the NIC, or step 4182 and step 4183, or step 4185.
  • the methods described in connection with the present disclosure can be implemented by a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, which can be stored in RAM, flash memory, ROM, erasable programmable read only memory (English: erasable programmable read only memory, abbreviation: EPROM), electrically erasable Programming an audio-only memory (English): hard disk, optical disk, or any other form of storage medium known in the art.
  • the functions described herein may be implemented in hardware or software.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种数据包处理方法，该方法运用于软件定义网络SDN中的计算设备。计算设备中的NIC接收到数据流的数据包后，根据数据包的匹配信息查询流表集合，如果在流表集合中匹配上流表，则根据该流表处理该数据包，如果在流表集合中无法匹配任一流表，则NIC将该数据包发送至虚拟交换机，以使虚拟交换机获取该数据包所在数据流对应的流表，并将该流表存入流表集合以供该NIC能够直接处理该数据包所在数据流的后续数据包。本申请提供的方法降低了虚拟交换机的工作负担，提升了计算设备的工作效率。

Description

网络接口卡、计算设备以及数据包处理方法 技术领域
本申请涉及计算机技术领域，尤其涉及一种网络接口卡(英文全称：network interface card，缩写：NIC)，一种用于处理数据包的计算设备，以及该NIC、该计算设备分别执行的数据包处理方法。
背景技术
云计算环境中，由于需要对数量较高的用户提供服务，因此用于提供云服务的数据中心中的计算设备的数量往往较多，而每个计算设备上又运行了多个虚拟机(英文全称：virtual machine，缩写：VM)，如图1中的VM-1至VM-n。VM与其他计算设备上运行的VM或同一计算设备上的VM之间通过虚拟交换机(英文全称：virtual switch，缩写：VS)通信，软件定义网络(英文全称：software defined networking，缩写：SDN)控制器对各个计算设备上的虚拟交换机集中进行控制。当前常见的虚拟交换机包括open vSwitch，SDN控制器通常通过OpenFlow协议定义的流表(英文全称：flow table)对各个虚拟交换机进行控制。
每个计算设备上的硬件资源至少需要支持运行多个VM、虚拟交换机以及虚拟机监视器(英文全称：virtual machine monitor)，虚拟机监视器又称为虚拟机管理器(英文全称：virtual machine manager)或管理程序(英文全称：hypervisor)。每台计算设备的硬件资源有限，如果负担了数据交换任务的虚拟交换机占用的硬件资源太多，则容易影响计算设备上VM的运行，降低工作效率。
发明内容
本申请提供了一种数据包处理方法，以提升数据包处理效率。
本申请的第一方面，提供了一种数据包处理方法，该方法应用于计算设备，该计算设备包括网络接口卡NIC和主机，该NIC与该主机建立通信连接，该主机运行虚拟机VM，该方法包括：该NIC接收数据流的第一数据包；该NIC根据该 第一数据包的匹配信息查询流表集合；在无法匹配到该数据流对应的流表情况下，该NIC向该主机上运行的虚拟交换机转发该第一数据包；其中，该虚拟交换机在接收到该第一数据包后，从SDN控制器获取该数据流对应的流表，以便于该数据流对应的流表被加入到该流表集合。
该虚拟交换机通过该第一数据包获取了该数据流对应的流表后，由该虚拟交换机或主机上运行的监控模块将该数据流对应的流表存入该流表集合。
实际运行中，该NIC接收一个数据包后，根据该数据包的匹配信息查询流表集合，如果无法获取该数据包所在数据流对应的流表，说明该数据包为该数据包所在数据流的首个数据包，或该数据包不是所在数据流的首个数据包，但该流表集合中该数据流对应的流表已经老化。
该数据包处理方法，由该NIC执行流表与数据包的匹配动作，提升了数据包的处理效率，并且将无法匹配到流表的数据包发送至虚拟交换机，以获取对应的流表用于NIC对该数据流后续的数据包的处理。
结合第一方面，在第一方面的第一种实现方式中，该主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM，该NIC接收该第一数据包前，该方法还包括：该NIC接收该虚拟交换机端口的配置信息；该NIC根据该虚拟交换机端口的配置信息，在该NIC上配置至少一个NIC端口，每个NIC端口通过单根-输入/输出虚拟化(英文全称：single root-input/output virtualization，缩写：SR-I/OV)技术与该主机上运行的一个VM连接。
虚拟交换机端口以及NIC端口的配置可以在第一方面提供的数据包处理方法之前完成，并且可以由该主机上运行的NIC驱动向该NIC发送该虚拟交换机端口的配置信息。
结合第一方面的第一种实现方式，在第一方面的第二种实现方式中，该数据流对应的流表包括该数据流的数据包的路由信息，在向该虚拟交换机转发该第一数据包之后，该方法还包括：该NIC，根据该第一数据包的匹配信息查询该流表集合，获取该数据流对应的流表，并根据该数据流的数据包的路由信息转发该第一数据包至目的VM。该数据流的数据包的路由信息指示该目的VM对应 的NIC端口。
该虚拟交换机或主机上运行的监控模块将该数据流对应的流表存入该流表集合后，由该NIC根据该第一数据包的匹配信息查询该流表集合，此时该流表集合中已经存有该数据流对应的流表。该NIC可以在将该第一数据包发送至该虚拟交换机之后，定期将该第一数据包与该流表集合中的流表进行匹配，或者该数据流对应的流表存入该流表集合后，向该NIC发送通知消息，指示该NIC执行该第一数据包与该流表集合中的流表的匹配。
该实现方式无须该虚拟交换机执行该第一数据包与流表的匹配，降低了该虚拟交换机的工作负担。
结合第一方面的第一种实现方式，在第一方面的第三种实现方式中，该数据流对应的流表包括该数据流的数据包的路由信息，在向该虚拟交换机转发该第一数据包之后，该方法还包括：该NIC接收该虚拟交换机返回的第一数据包，该返回的第一数据包中包含该对应于目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口标识；该NIC根据该端口标识，转发该第一数据包到该目的VM，该端口标识由该虚拟交换机根据该数据流的数据包的路由信息添加。
该实现方式无须该NIC与该第一数据包的匹配，提升了数据包的处理效率。
结合第一方面的第一种实现方式，在第一方面的第四种实现方式中，该虚拟交换机与该NIC通过至少一个队列通信，每个队列对应该主机上运行的一个VM；在向该虚拟交换机转发该第一数据包之后，该方法还包括：该NIC从该第一数据包的目的VM对应的队列接收该第一数据包；该NIC根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第一数据包至该目的VM。
该虚拟交换机获取该数据流的数据包的路由信息后，根据该数据流的数据包的路由信息将该第一数据包存入该目的VM对应的队列中。该NIC从该目的VM对应的队列接收该第一数据包，主机上运行的NIC驱动向该NIC发送该目的VM对应的队列的队列信息，该队列信息用于通知该NIC该第一数据包从该目的VM对应的队列获得，该NIC根据预存的队列与NIC端口的对应关系，从该目的VM对应的NIC端口转发该第一数据包至该目的VM。
该实现方式无须该NIC与该第一数据包的匹配，与前述第三种实现方式相比， 也无须该NIC对端口标识的转换，进一步提升了数据包的处理效率。
本申请的第二方面，提供了一种NIC，该NIC用于执行本申请第一方面提供的数据包处理方法。该NIC包括：主机接口、网络接口和处理芯片，该网络接口用于与外部网络通信且该网络接口与该处理芯片建立通信连接，该主机接口用于与主机通信且该主机接口与该处理芯片建立通信连接，该主机运行VM；该网络接口，用于接收数据流的第一数据包；该处理芯片，用于根据该第一数据包的匹配信息查询流表集合，在无法匹配到该数据流对应的流表情况下，通过该主机接口向该主机上运行的虚拟交换机转发该第一数据包；其中，该虚拟交换机在接收到该第一数据包后，从SDN控制器获取该数据流对应的流表，以便于该数据流对应的流表被加入到该流表集合。
该NIC能够执行流表与数据包的匹配动作，提升了数据包的处理效率，并且该NIC将无法匹配到流表的数据包发送至虚拟交换机，以获取对应的流表用于NIC对该数据流后续的数据包的处理。
结合第二方面，在第二方面的第一种实现方式中，该主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM；该处理芯片，还用于接收该虚拟交换机端口的配置信息，根据该虚拟交换机端口的配置信息，在该NIC上配置至少一个NIC端口，每个NIC端口通过SR-I/OV技术与该主机上运行的一个VM连接。
结合第二方面的第一种实现方式，在第二方面的第二种实现方式中，该处理芯片，还用于根据该第一数据包的匹配信息查询该流表集合，获取该数据流对应的流表，该数据流对应的流表包括该数据流的数据包的路由信息，并根据该数据流的数据包的路由信息转发该第一数据包至目的VM。
该实现方式中，无须该虚拟交换机与该第一数据包的匹配，降低了该虚拟交换机的工作负担。
结合第二方面的第一种实现方式，在第二方面的第三种实现方式中，该处理芯片，还用于接收该虚拟交换机返回的第一数据包，该返回的第一数据包中包含对应于目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口 标识，该端口标识由该虚拟交换机根据该数据流的数据包的路由信息添加，该数据流对应的流表包括该数据流的数据包的路由信息；还用于根据该端口标识，转发该第一数据包到该目的VM。
该实现方式中，该NIC无须将该第一数据包与流表进行匹配，提升了数据包的处理效率。
结合第二方面的第一种实现方式，在第二方面的第四种实现方式中，该虚拟交换机与该NIC通过至少一个队列通信，每个队列对应该主机上运行的一个VM；该处理芯片，还用于从该第一数据包的目的VM对应的队列接收该第二数据包，并根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第二数据包至该目的VM。
该实现方式中，该NIC无须将该第一数据包与流表进行匹配，并且与前述第三种实现方式相比，该NIC也无须对该端口标识进行转换，进一步提升了数据包的处理效率。
本申请第三方面提供了一种数据包处理方法，该方法应用于计算设备，该计算设备包括网络接口卡NIC和主机，该NIC与该主机建立通信连接，该主机运行虚拟机VM，该方法包括：该NIC接收数据流的第二数据包；该NIC根据该第二数据包的匹配信息查询流表集合，获取该数据流对应的流表，该数据流对应的流表包括该数据流的数据包的路由信息；该NIC根据该数据流的数据包的路由信息，转发该第二数据包到目的VM。
该数据包处理方法，由该NIC执行流表与数据包的匹配动作，提升了数据包的处理效率。
结合第三方面，在第三方面的第一种实现方式中，该NIC通过SR-I/OV技术与该主机上运行的VM连接；该NIC根据该数据流的数据包的路由信息，通过该NIC与该目的VM的连接转发该第二数据包到该目的VM。
结合第三方面的第一种实现方式，在第三方面的第二种实现方式中，该主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM；该NIC接收数据流的第二数据包前，该方法还包 括：该NIC接收该虚拟交换机端口的配置信息；根据该虚拟交换机端口的配置信息，在该NIC上配置至少一个NIC端口，每个NIC端口通过SR-I/OV技术与该主机上运行的一个VM连接，该数据流的数据包的路由信息指示该目的VM对应的NIC端口。
结合第三方面的第二种实现方式，在第三方面的第三种实现方式中，该NIC接收数据流的第二数据包前，该方法还包括：该NIC接收该数据流的第三数据包；该NIC根据该第三数据包的匹配信息查询该流表集合；在无法匹配到该数据流对应的流表情况下，该NIC向该主机上运行的虚拟交换机转发该第三数据包；其中，该虚拟交换机在接收到该第三数据包后，从SDN控制器获取该数据流对应的流表，以便于该数据流对应的流表被加入到该流表集合。
结合第三方面的第三种实现方式，在第三方面的第四种实现方式中，在向该虚拟交换机转发该第三数据包之后，该方法还包括：该NIC根据该第三数据包的匹配信息查询该流表集合，获取该数据流对应的流表，并根据该数据流的数据包的路由信息转发该第三数据包至该目的VM。
结合第三方面的第三种实现方式，在第三方面的第五种实现方式中，在向该虚拟交换机转发该第三数据包之后，该方法还包括：该NIC接收该虚拟交换机返回的第三数据包，该返回的第三数据包中包含对应于该目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口标识，该端口标识由该虚拟交换机根据该数据流的数据包的路由信息添加；该NIC根据该端口标识，转发该第三数据包到该目的VM。
结合第三方面的第三种实现方式，在第三方面的第六种实现方式中，该虚拟交换机与该NIC通过至少一个队列通信，每个队列对应该主机上运行的一个VM；在向该虚拟交换机转发该第三数据包之后，该方法还包括：该NIC从该目的VM对应的队列接收该第三数据包；该NIC根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第三数据包至该目的VM。
结合第三方面或第三方面的前述任一种实现方式，在第三方面的第七种实现方式中，该NIC接收数据流的第二数据包包括：该NIC接收overlay类型数据包，该overlay类型数据包包括overlay头和该第二数据包，该overlay头包括虚拟可扩展 局域网VXLAN头，或使用通用路由的网络虚拟化NVGRE头，或无状态传输隧道STT头；该NIC剥去该overlay类型数据包的overlay头，获取该第二数据包。
需要说明的是，如果该数据流的数据包均采用了overlay技术，该NIC也需要对将该第三数据包对应的overlay头剥离后，才能获取该第三数据包。本实现方式中，示例性的提出了该NIC对该overlay类型数据包的剥离，实际上该NIC接收该数据流的其他overlay类型数据包后，也会将其overlay头剥离以获取内层的数据包。
该实现方式中，该NIC实现了对overlay头的剥离，降低了主机的工作负担。
结合第三方面或第三方面的前述任一种实现方式，在第三方面的第八种实现方式中，该NIC转发该第二数据包到目的VM之前，该方法还包括：该NIC对该第二数据包进行安全组检查，在确定该第二数据包的安全组检查通过之后，执行转发该第二数据包到该目的VM的步骤。
需要说明的是，如果该数据流的数据包均设置了安全组，，该NIC也需要对确定该第三数据包的安全组检查通过后，才转发该第三数据包。本实现方式中，示例性的提出了该NIC对该第二数据包的安全组检查，实际上该NIC转发该数据流的其他数据包之前，也需要对其进行安全组检查。
该实现方式中，该NIC还实现了对该第二数据包的安全组检查，提升了数据包收发的安全的同时，进一步降低了主机的工作负担。
本申请的第四方面提供了一种NIC，该NIC用于执行前述第三方面提供的数据包处理方法。该NIC包括：主机接口、网络接口和处理芯片，该网络接口用于与外部网络通信且该网络接口与该处理芯片建立通信连接，该主机接口用于与主机通信且该主机接口与该处理芯片建立通信连接，该主机运行VM；该网络接口，用于接收数据流的第二数据包；该处理芯片，用于根据该第二数据包的匹配信息查询流表集合，获取该数据流对应的流表，该数据流对应的流表包括该数据流的数据包的路由信息；以及根据该数据流的数据包的路由信息，转发该第二数据包到目的VM。
结合第四方面，在第四方面的第一种实现方式中，该NIC通过SR-I/OV技术与该主机上运行的VM连接；
该处理芯片，用于根据该数据流的数据包的路由信息，通过该NIC与该目的VM的连接转发该第二数据包到该目的VM。
结合第四方面的第一种实现方式，在第四方面的第二种实现方式中，该主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM；该处理芯片，还用于接收该虚拟交换机端口的配置信息，根据该虚拟交换机端口的配置信息在该NIC上配置至少一个NIC端口，每个NIC端口通过SR-I/OV技术与该主机上运行的一个VM连接，该数据流的数据包的路由信息指示该目的VM对应的NIC端口。
结合第四方面的第二种实现方式，在第四方面的第三种实现方式中，该网络接口，还用于接收该数据流的第三数据包；该处理芯片，还用于根据该第三数据包的匹配信息查询该流表集合，在无法匹配到该数据流对应的流表情况下，向该主机上运行的虚拟交换机转发该第三数据包；其中，该虚拟交换机在接收到该第三数据包后，从SDN控制器获取该数据流对应的流表，以便于该数据流对应的流表被加入到该流表集合。
结合第四方面的第三种实现方式，在第四方面的第四种实现方式中，该处理芯片，还用于根据该第三数据包的匹配信息查询该流表集合，获取该数据流对应的流表，并根据该数据流的数据包的路由信息转发该第三数据包至该目的VM。
结合第四方面的第三种实现方式，在第四方面的第五种实现方式中，该处理芯片，还用于接收该虚拟交换机返回的第三数据包，该返回的第三数据包中包含对应于该目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口标识，该端口标识由该虚拟交换机根据该数据流的数据包的路由信息添加；还用于根据该端口标识，转发该第三数据包到该目的VM。
结合第四方面的第三种实现方式，在第四方面的第六种实现方式中，该虚拟交换机与该NIC通过至少一个队列通信，每个队列对应该主机上运行的一个VM；该处理芯片，还用于从该目的VM对应的队列接收该第三数据包，并根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第三数据包至该目的VM。
结合第四方面或第四方面的前述任一种实现方式，在第四方面的第七种实现方式中，该网络接口，用于接收overlay类型数据包，该overlay类型数据包包括overlay头和该第二数据包，该overlay头包括虚拟可扩展局域网VXLAN头，或使用通用路由的网络虚拟化NVGRE头，或无状态传输隧道STT头；该处理芯片，用于剥去该overlay类型数据包的overlay头，获取该第二数据包。
结合第四方面或第四方面的前述任一种实现方式，在第四方面的第八种实现方式中，该处理芯片转发该第二数据包到该目的VM之前，还用于对该第二数据包进行安全组检查，在确定该第二数据包的安全组检查通过之后，执行转发该第二数据包到该目的VM的步骤。
本申请的第五方面提供了一种计算设备，该计算设备包括网络接口卡NIC和主机，该NIC与该主机建立通信连接，该主机上运行虚拟机VM和虚拟交换机，该虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM；该主机，用于向该NIC发送该虚拟交换机端口的配置信息；该NIC，用于根据该虚拟交换机端口的配置信息，在该NIC上配置至少一个NIC端口，每个NIC端口通过SR-I/OV技术与该主机上运行的一个VM连接；该NIC，还用于接收数据流的第二数据包，根据该第二数据包的匹配信息查询流表集合，获取该数据流对应的流表，该数据流对应的流表包括该数据流的数据包的路由信息，该数据流的数据包的路由信息指示目的VM对应的NIC端口，以及根据该数据流的数据包的路由信息，转发该第一数据包到该目的VM。
结合第五方面，在第五方面的第一种实现方式中，该NIC，还用于接收该数据流的第三数据包，根据该第三数据包的匹配信息查询该流表集合，在无法匹配到该数据流对应的流表情况下，向该主机转发该第三数据包；该主机，用于在接收到该第三数据包后，从SDN控制器获取该数据流对应的流表，以便于该数据流对应的流表被加入到该流表集合。
具体的，该NIC向该主机上运行的虚拟交换机发送该第三数据包。
结合第五方面的第一种实现方式，在第五方面的第二种实现方式中，该NIC，还用于根据该第三数据包的匹配信息查询该流表集合，获取该数据流对应的流 表，以及根据该数据流的数据包的路由信息转发该第三数据包至该目的VM。
该NIC在该数据流对应的流表被加入到该流表集合后，根据该第三数据包的匹配信息查询该流表集合。
结合第五方面的第一种实现方式，在第五方面的第三种实现方式中，该主机，还用于生成返回的第三数据包，该返回的第三数据包中包含对应于该目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口标识，该端口标识由该主机根据该数据流的数据包的路由信息添加；该NIC，还用于接收该返回的第三数据包，并根据该端口标识，转发该第三数据包到该目的VM。
结合第五方面的第一种实现方式，在第五方面的第四种实现方式中，该虚拟交换机与该NIC通过至少一个队列通信，每个队列对应该主机上运行的一个VM；该主机，还用于将该第三数据包发送至该目的VM对应的队列；该NIC，还用于从该目的VM对应的队列接收该第三数据包，以及根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第三数据包至该目的VM。
该主机在接收到该NIC在发来的该第三数据包之后，将该第三数据包发送至该目的VM对应的队列。
结合第五方面或第五方面的前述任一种实现方式，在第五方面的第五种实现方式中，该NIC，具体用于接收overlay类型数据包，该overlay类型数据包包括overlay头和该第二数据包，该overlay头包括虚拟可扩展局域网VXLAN头，或使用通用路由的网络虚拟化NVGRE头，或无状态传输隧道STT头，以及剥去该overlay类型数据包的overlay头，获取该第二数据包。
结合第五方面或第五方面的前述任一种实现方式，在第五方面的第六种实现方式中，该NIC转发该第二数据包到目的VM之前，还用于对该第二数据包进行安全组检查，在确定该第二数据包的安全组检查通过之后，执行转发该第二数据包到该目的VM的步骤。
本申请的第六方面提供了一种数据包处理方法，该方法运用于前述第五方面提供的计算设备。该方法包括：主机向NIC发送该虚拟交换机端口的配置信息；该NIC根据该虚拟交换机端口的配置信息，在该NIC上配置至少一个NIC端口， 每个NIC端口通过SR-I/OV技术与该主机上运行的一个VM连接；该NIC接收数据流的第二数据包，根据该第二数据包的匹配信息查询流表集合，获取该数据流对应的流表，该数据流对应的流表包括该数据流的数据包的路由信息，该数据流的数据包的路由信息指示目的VM对应的NIC端口，以及根据该数据流的数据包的路由信息，转发该第二数据包到该目的VM。
结合第六方面，在第六方面的第一种实现方式中，该方法还包括：该NIC接收该数据流的第三数据包，根据该第三数据包的匹配信息查询该流表集合，在无法匹配到该数据流对应的流表情况下，向该主机转发该第三数据包；该主机在接收到该第三数据包后，从SDN控制器获取该数据流对应的流表，以便于该数据流对应的流表被加入到该流表集合。
结合第六方面的第一种实现方式，在第六方面的第二种实现方式中，在该数据流对应的流表被加入到该流表集合之后，该方法还包括：该NIC根据该第三数据包的匹配信息查询该流表集合，获取该数据流对应的流表，以及根据该数据流的数据包的路由信息转发该第三数据包至该目的VM。
结合第六方面的第一种实现方式，在第六方面的第三种实现方式中，在该NIC向该主机转发该第三数据包之后，该方法还包括：该主机生成返回的第三数据包，该返回的第三数据包中包含对应于该目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口标识，该端口标识由该主机根据该数据流的数据包的路由信息添加；该NIC接收该返回的第三数据包，并根据该端口标识，转发该第三数据包到该目的VM。
结合第六方面的第一种实现方式，在第六方面的第四种实现方式中，该虚拟交换机与该NIC通过至少一个队列通信，每个队列对应该主机上运行的一个VM；在该NIC向该主机转发该第三数据包之后，该方法还包括：该主机将该第三数据包发送至该目的VM对应的队列；该NIC从该目的VM对应的队列接收该第三数据包，以及根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第三数据包至该目的VM。
结合第六方面或第六方面的前述任一种实现方式，在第六方面的第五种实现方式中，该NIC接收该第二数据包具体包括：该NIC接收overlay类型数据包， 该overlay类型数据包包括overlay头和该第二数据包，该overlay头包括虚拟可扩展局域网VXLAN头，或使用通用路由的网络虚拟化NVGRE头，或无状态传输隧道STT头，以及剥去该overlay类型数据包的overlay头，获取该第二数据包。
结合第六方面或第六方面的前述任一种实现方式，在第六方面的第六种实现方式中，该NIC转发该第二数据包到目的VM之前，该方法包括：该NIC对该第二数据包进行安全组检查，在确定该第二数据包的安全组检查通过之后，执行转发该第二数据包到该目的VM的步骤。
本申请的第七方面，提供了一种配置方法，该配置方法应用于主机，该主机与NIC建立通信连接，该主机运行VM、虚拟交换机和NIC驱动，该主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM，该方法包括：该NIC驱动向该NIC发送该虚拟交换机端口的配置信息，该虚拟交换机端口的配置信息指示在该NIC上配置至少一个NIC端口，每个NIC端口通过SR-I/OV技术与该主机上运行的一个VM连接。
本申请的第八方面，提供了一种数据包处理方法，该方法应用于执行了本申请第七方面提供的配置方法的主机，该主机运行时执行本申请第五方面提供的数据包处理方法中主机侧的部分。该方法包括：该主机上运行的虚拟交换机接收数据流的第三数据包；该虚拟交换机从SDN控制器获取该数据流对应的流表；该虚拟交换机或该主机运行的监控模块将该数据流对应的流表加入到流表集合。
结合第八方面，在第八方面的第一种实现方式中，在该数据流对应的流表被加入到该流表集合后，该方法还包括：该虚拟交换机向该NIC发送通知消息，该通知消息用于通知该NIC该数据流对应的流表已经加入到流表集合，以使得该NIC根据该流表集合中的该数据流对应的流表，处理该第三数据包。
结合第八方面，在第八方面的第二种实现方式中，该数据流对应的流表包括该数据流的数据包的路由信息，该方法还包括：该虚拟交换机根据该数据流的数据包的路由信息生成返回的第三数据包，将该返回的第三数据包发送至该 NIC，该返回的第三数据包中包含对应于该目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口标识，以使该NIC根据该端口标识转发该第三数据包到该目的VM。
结合第八方面，在第八方面的第三种实现方式中，该虚拟交换机与该NIC通过至少一个队列通信，每个队列对应该主机上运行的一个VM；该方法还包括：该虚拟交换机将该第三数据包发送至该目的VM对应的队列；该NIC驱动将该目的VM对应的队列的队列信息发送至该NIC，以使该NIC根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第三数据包至该目的VM。
本申请第九方面提供了一种主机，该主机包括处理器、存储器、总线，该处理器和该存储器通过该总线建立通信连接，该处理器运行时，执行前述第七方面提供的配置方法。
本申请第十方面提供了一种主机，该主机包括处理器、存储器、总线，该处理器和该存储器通过该总线建立通信连接，该处理器运行时，执行前述第八方面或第八方面的任一种实现方式提供的数据包处理方法。
本申请的第十一方面，提供了一种存储介质，该存储介质中存储了程序代码，该程序代码被计算设备运行时，执行第七方面提供的配置方法。该存储介质包括但不限于快闪存储器、硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid state drive，缩写：SSD)。
本申请的第十二方面，提供了一种存储介质，该存储介质中存储了程序代码，该程序代码被计算设备运行时，执行第八方面或第八方面的任意一种实现方式提供的数据包处理方法。该存储介质包括但不限于快闪存储器、HDD或SSD。
本申请的第十三方面，提供了一种计算机程序产品，该计算机程序产品可以为一个软件安装包，该软件安装包被计算设备运行时，执行第七方面提供的 配置方法。
本申请的第十四方面，提供了一种计算机程序产品，该计算机程序产品可以为一个软件安装包，该软件安装包被计算设备运行时，执行第八方面或第八方面的任意一种实现方式提供的数据包处理方法。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例中所需要使用的附图作以简单地介绍，显而易见的，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为现有技术中数据中心架构的示意图；
图2a为本申请实施例提供的SDN架构的示意图；
图2b为现有技术中SDN中的计算设备的组织结构示意图；
图2c为本申请实施例提供的计算设备的组织结构示意图；
图3为本申请实施例提供的又一计算设备的组织结构示意图；
图4为本申请实施例提供的数据包处理方法的流程示意图；
图5a为本申请实施例提供的另一计算设备的组织结构示意图；
图5b为本申请实施例提供的另一计算设备的组织结构示意图；
图5c为本申请实施例提供的另一计算设备的组织结构示意图；
图5d为本申请实施例提供的另一计算设备的组织结构示意图；
图6a为本申请实施例提供的NIC的组织结构示意图；
图6b为本申请实施例提供的又一NIC的组织结构示意图；
图6c为本申请实施例提供的又一NIC的组织结构示意图。
具体实施方式
下面结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
本申请中采用术语第一、第二、第三等来区分各个对象，例如第一数据包、第二数据包、第三数据包等，但各个“第一”、“第二”、“第三”之间不具有逻辑或时序上的依赖关系。
贯穿本说明书，数据包由匹配信息和载荷(英文全称：payload)构成。其中，匹配信息用于与流表的匹配域进行匹配。
贯穿本说明书，流表(英文全称：flow table)用于在SDN中控制数据流，也可以称为SDN流表，具体可以采用符合OpenFlow协议的流表或符合其他协议的流表。流表至少包括匹配域和执行域，该匹配域用于与数据包进行匹配，该执行域用于指示匹配上流表的数据包应该执行的动作。执行域包括了数据包的动作标识，例如转发、丢弃、上送SDN控制器等，执行域还包括了数据包的路由信息，例如数据包的目的端口标识等。
贯穿本说明书，数据流(英文全称：data flow)指示能够匹配相同流表的一系列数据包。具体的，同一数据流中的数据包的匹配信息，均可以匹配上该数据流对应的流表的匹配域。
贯穿本说明书，虚拟交换机为安装在计算设备上的，通过软件实现的交换设备，常用于SDN中。常见的虚拟交换机包括Open vSwitch，缩写为OVS，OVS为一个开源项目提供的虚拟交换机。
贯穿本说明书，overlay类型数据包指代采用了overlay封装技术处理的数据包，具体的overlay封装技术包括了虚拟可扩展局域网(英文全称：virtual extensible local area network，缩写：VXLAN)技术，使用通用路由的网络虚拟化(英文全称：network virtualization using generic routing encapsulation，缩写：NVGRE)技术和无状态传输隧道(英文全称：stateless transport tunneling，缩写：STT)技术。Overlay类型数据包包括两个部分，overlay头和原始数据包，该原始数据包指代VM发出的数据包或经过虚拟交换机的端口发往VM的数据包，该overlay头叠加在该原始数据包上，以用于该overlay类型数据包在overlay网络中传输。不同的overlay封装技术对应于不同的overlay头。
贯穿本说明书，流表集合中包括了一个或多个流表。本申请中包括两个流表集合，即虚拟交换机可访问流表集合和NIC可访问流表集合。虚拟交换机可访问流表集合中的流表供虚拟交换机使用，NIC可访问流表集合中的流表供NIC使用。具体的，如图2c所示，虚拟交换机可访问流表集合一般存储于计算设备 的存储设备中，NIC可访问流表集合可以存储于计算设备的存储设备中，也可以存储于NIC内部的存储设备中。若虚拟交换机可访问流表集合和NIC可访问流表集合均存储于计算设备的存储设备中，计算设备在其存储设备中为虚拟交换机可访问流表集合和NIC可访问流表集合分别开辟一块内存空间。本申请的附图中，以NIC可访问流表集合存储于计算设备的存储设备中为例进行介绍，本领域技术人员可以直接推导出NIC可访问流表集合存储于NIC内部的情况。
贯穿本说明书，示例性的采用了SR-IOV的NIC与VM直连的技术，在实际使用中也可以采用其他支持NIC与VM直连的技术。
本申请实施例所应用的SDN架构
图2a为本申请实施例所应用的SDN架构的示意图，图2a中示意性的采用了集中式的SDN控制器，实际中SDN控制器也可以分布式的部署于各个计算设备。
各个计算设备上的硬件层设置有NIC，处理器以及存储设备。本申请中，将每个计算设备除NIC之外的部分称之为主机。其中，处理器可以为中央处理器(英文：central processing unit，缩写：CPU)，存储设备包括易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)，以及非易失性存储器(英文：non-volatile memory)，例如只读存储器(英文：read-only memory，缩写：ROM)、快闪存储器、HDD或SSD等。每个主机运行时，其硬件层支持软件层内的虚拟交换机以及多个VM的运行。每个计算设备内的主机和NIC建立通信连接，主机通过NIC与外部网络通信，例如首先由NIC从外部网络获取发往该主机上运行的VM数据包，然后发送至主机上运行的VM，而该主机上运行的VM发往外部网络的数据包首先发送至NIC，然后通过NIC发送至外部网络。
下面以计算设备1为例展示现有技术中的数据包处理流程与本申请提供的数据包处理流程的区别。如图2b，现有技术中，计算设备1内的NIC从外部网络接收到数据包后，如果判断该数据包的目的地属于计算设备1则将该数据包发送至虚拟交换机，则由虚拟交换机将该数据包与虚拟交换机可访问流表集合中的流表进行匹配，并根据匹配上的流表的指示，将该数据包发送至与该虚拟交换机相连的目的VM。由以上数据包的处理流程可见，现有技术中，数据包处 理过程中主要的运行压力集中在虚拟交换机上，而虚拟交换机的运行依赖于计算设备上的硬件层的资源，虚拟交换机占用的处理器和存储设备资源越多，计算设备上能够用于VM运行的资源就越少，而如果限定虚拟交换机能够占用的硬件层的资源的上限，那么随着数据包流量的增大，虚拟交换机的性能将难以保证。
如图2c，本申请提供的数据包处理流程中，计算设备1内的NIC从外部网络接收到数据包后，如果判断该数据包的目的VM运行于计算设备1上，则将该数据包与NIC可访问流表集合中的流表进行匹配，并根据匹配上的流表的指示，将该数据包发送至与该NIC相连的目的VM。该NIC可访问流表集合内的流表来源于主机，NIC如果无法将该数据包匹配上NIC可访问流表集合中的流表，就会将该数据包发送至虚拟交换机，虚拟交换机向SDN控制器请求获取该数据包对应的流表，并将获取的该数据包对应的流表发送至NIC可访问流表集合，以供NIC在接下来的数据包处理过程中使用。
由以上数据包的处理流程可见，在本申请提供的数据包处理流程中，数据包的处理过程中的一部分运行压力被转移到了NIC上，而NIC作为一个硬件设备，不仅处理效率高，并且其运行无需占用硬件层的其他资源。
需要说明的是，示意性的，图2c中的计算设备1上的所有VM都与NIC相连，实际上也可以只有部分VM与NIC相连，其他部分VM与虚拟交换机相连，具体VM的配置方式并不限定于必须全部都与NIC相连。
图2a和图2c中的计算设备可以通过图3所示的计算设备200实现，其组织结构示意图如图3所示，计算设备200包括了主机以及NIC206，NIC206通过主机的总线208与主机的处理器202以及存储器204建立通信连接，NIC206、处理器202和存储器204之间也可以通过无线传输等其他手段实现通信。计算设备200通过NIC206与外部网络通信。
工作状态下，主机运行了至少一个VM以及虚拟交换机，且用于实现图4提供的数据包处理方法中主机侧的方法的程序代码保存在存储设备204中，并由处理器202执行。工作状态下，NIC206执行图4提供的数据包处理方法中NIC侧的方法。
本申请还提供了一种数据包处理方法，前述SDN架构中的计算设备运行时执行该方法，其流程示意图如图4所示。
步骤402，计算设备的主机接收第一虚拟交换机端口的配置信息，该第一虚拟交换机端口的配置信息指示在虚拟交换机上建立至少一个虚拟交换机端口，每个虚拟交换机端口对应该主机上运行的一个VM。
步骤404，该主机生成第二虚拟交换机端口的配置信息，并将该第二虚拟交换机端口的配置信息发送至计算设备的NIC。
具体的，该主机上运行的拦截模块，获取该第一虚拟交换机端口的配置信息，将该第一虚拟交换机端口的配置信息发送至该主机上运行的NIC驱动，该NIC驱动根据该第一虚拟交换机端口的配置信息，生成该第二虚拟交换机端口的配置信息，并发送至该NIC。该第一虚拟交换机端口的配置信息与该第二虚拟交换机端口的配置信息的功能类似，该NIC驱动对其转换主要为了符合NIC驱动与NIC通信的规范。
步骤406，该NIC根据该第二虚拟交换机端口的配置信息，在该NIC上配置至少一个NIC端口，每个NIC端口通过SR-I/OV技术与该主机上运行的一个VM连接。
NIC端口具体可以为SR-I/OV技术定义的虚拟功能(英文全称：virtual function，缩写：VF)的端口。
步骤402至步骤406为可选步骤，且步骤402至步骤406为该虚拟交换机和该NIC的配置过程，无须每次执行步骤408及步骤408的后续步骤前都执行一次步骤402至步骤406。如图5a或图5b或图5c，通过该配置过程，主机上运行的VM通过NIC端口与NIC连接，虚拟交换机上虽然建立了与VM一一对应的VS端口，但主机上运行的VM并不与虚拟交换机连接。
由于VS端口与VM一一对应，同时VM与NIC端口一一对应，因此VS端口与NIC端口一一对应。在步骤402至步骤406的执行过程中将VS端口与NIC端口的对应关系存入该虚拟交换机，或将VS端口与NIC端口的对应关系存入该NIC。
如图5b或图5c，该虚拟交换机和该NIC的配置过程中，或该虚拟交换机和该NIC的配置过程之前或之后，还需要配置该虚拟交换机与该NIC通信的至少一个 队列，用于该虚拟交换机将从NIC接收到的数据包返回给该NIC。队列的配置有两种方式，其一如图5b所示，该虚拟交换机与该NIC通过一个队列通信，该虚拟交换机将需要发往该NIC的全部数据包发送至该队列；其二如图5c所示，该虚拟交换机与该NIC通过n个队列通信，n为该主机上运行的VM的数量，每一个队列与一个VM对应。
该配置过程无须上层管理设备的感知，由该计算设备将本应连接于虚拟交换机的VM连接于NIC上，无须上层管理设备对配置信息进行修改，提升了配置过程的兼容性和降低了实现难度。
步骤408，该NIC接收第一overlay类型数据包，该第一overlay类型数据包包括第一overlay头和该第一数据包，该第一overlay头包括VXLAN头，或NVGRE头，或STT头。
该第一overlay类型数据包可以为外部网络发送至该NIC的。
步骤410，该NIC剥去该第一overlay类型数据包的第一overlay头，获取该第一数据包。
相对于现有技术中，由主机执行剥离overlay头的动作，由NIC剥离overlay头降低了主机的工作负担。
需要说明的是，如果步骤408中该NIC接收的不是overlay类型数据包，而是直接接收到第一数据包，则无须执行步骤410。
步骤412，该NIC根据该第一数据包的匹配信息查询NIC可访问流表集合。若无法匹配NIC可访问流表集合中的任一流表，则执行步骤414、步骤416、步骤4181，或步骤4182至步骤4184，或步骤4185至步骤4186。若能够匹配NIC可访问流表集合中的流表，则执行步骤420。
如果该第一数据包的匹配信息无法匹配NIC可访问流表集合中的任一流表，则该第一数据包为该第一数据包所在的数据流的首个数据包，或该第一数据包不是该数据流的首个数据包，但该数据流对应的流表在NIC可访问流表集合中已经被删除。
如果该第一数据包的匹配信息能够匹配NIC可访问流表集合中的流表，则说明NIC可访问流表集合中已经存有该第一数据包所在的数据流对应的流表。
步骤414，该NIC通过主机端口向该虚拟交换机转发该第一数据包。
该主机端口可以为SR-I/OV技术定义的物理功能(英文全称：physical function，缩写：PF)的端口。
步骤416，该虚拟交换机在接收到该第一数据包后，获取该数据流对应的流表，该数据流对应的流表被加入到该NIC可访问流表集合。
该虚拟交换机获取该第一数据包后，将该第一数据包发送至SDN控制器，并接收SDN控制器根据该第一数据包生成的该数据流对应的流表。虚拟交换机可访问流表集合中，还可能存储有生成该数据流对应的流表所需的信息，例如慢表(英文全称：slow table)，则该虚拟交换机根据该信息生成该数据流对应的流表即可，无须将该第一数据包发送至SDN控制器。
该虚拟交换机将该数据流对应的流表存入虚拟交换机可访问流表集合和NIC可访问流表集合。或者，该主机上运行的监控模块监控该虚拟交换机获取该数据流对应的流表，该监控模块将该数据流对应的流表存入NIC可访问流表集合。
由于该数据流对应的流表由SDN控制器生成，而SDN控制器无须知道主机上运行的VM实际连接于NIC。因此该数据流的数据包的路由信息具体可以包括VS端口标识，而VS端口与VM一一对应，同时VM与NIC端口一一对应，因此VS端口与NIC端口一一对应，该数据流的数据包的路由信息指示目的VM的NIC端口。
步骤416后，将该第一数据包发送至其目的VM有三种可选的方案，分别为步骤4181、步骤4182至步骤4184和步骤4185至步骤4186，实际步骤416后可以执行这三种可选方案中的任一种。
步骤4181，该NIC根据该第一数据包的匹配信息查询该NIC可访问流表集合，获取该数据流对应的流表，并根据该数据流的数据包的路由信息转发该第一数据包至该目的VM。
这种情况下，该NIC需要存有VS端口标识与NIC端口标识的对应关系，该NIC获取该数据流的数据包的路由信息包括的VS端口标识后，将VS端口标识转换为NIC端口标识，并将该第一数据包从该NIC端口标识对应的NIC端口发出。
步骤416中该虚拟交换机或该监控模块将该数据流对应的流表存储到NIC可 访问流表集合后，向该NIC发送通知消息，该通知消息用于通知该NIC该数据流对应的流表已经存储于NIC可访问流表集合。该NIC接收到该通知信息后，根据该第一数据包的匹配信息在该NIC可访问流表集合中可以匹配上该数据流对应的流表。
或者，该NIC在步骤414后，周期性的根据该第一数据包的匹配信息匹配该NIC可访问流表集合的流表，在步骤416执行完毕后该NIC的下一次匹配中，该NIC根据该第一数据包的匹配信息在该NIC可访问流表集合中可以匹配上该数据流对应的流表。
可选步骤4181无须虚拟交换机将该第一数据包和该数据流对应的流表进行匹配，降低了虚拟交换机的工作负担。
步骤4182，该虚拟交换机将该第一数据包与该虚拟交换机可访问流表集合中的该数据流对应的流表进行匹配，获取该数据流的数据包的路由信息。
步骤4183，该虚拟交换机，根据该数据流的数据包的路由信息生成返回的第一数据包，将该返回的第一数据包发送至该NIC，该返回的第一数据包中包含对应于该目的VM的端口标识，该端口标识为虚拟交换机端口标识或NIC端口标识。
步骤4184，该NIC接收该返回的第一数据包，并根据该端口标识，转发该第二数据包到该目的VM。
如图5b，如步骤416中所述，该数据流的数据包的路由信息具体可以包括VS端口标识。例如，该第一数据包的目的VM为VM-1，VM-1在虚拟交换机上对应的端口为VS端口1，VM-1在NIC上对应的端口为NIC端口1，则该数据流的数据包的路由信息包括VS端口1。步骤4183中，该虚拟交换机生成的该返回的第一数据包中包含了该第一数据包的目的VM的端口标识和该第一数据包，而该第一数据包的目的VM的端口标识为VS端口1或NIC端口1。
步骤4183中可选的，该虚拟交换机将该数据流的数据包的路由信息添加到该返回的第一数据包中，则该目的VM的端口标识为VS端口1，并通过队列发送至该NIC。这种情况下，该NIC需要存有VS端口标识与NIC端口标识的对应关系，该NIC接收到该返回的第一数据包后，将该VS端口1转换为NIC端口1，并将该第 一数据包通过NIC端口1发送至VM-1。这种实施方式下该虚拟交换机的负载更低，提升了主机的工作效率。
步骤4183中可选的，该虚拟交换机获取将该数据流的数据包的路由信息后，将该数据流的数据包的路由信息包括的VS端口1转换为NIC端口1，并将NIC端口1添加到该返回的第一数据包中，则该目的VM的端口标识为NIC端口1，并通过队列将该返回的第一数据包发送至该NIC。这种情况下，该虚拟交换机需要存有VS端口标识与NIC端口标识的对应关系。该NIC接收到该返回的第一数据包后，将该第一数据包通过NIC端口1发送至VM-1。这种实施方式下，NIC无须对端口标识进行转换，可以更高效的处理数据包。
步骤4185，该虚拟交换机将该第一数据包发送至该目的VM对应的队列。该虚拟交换机与该NIC通过至少一个队列通信，每个主机上运行的VM对应一个队列。
步骤4186，该NIC从该目的VM对应的队列接收该第一数据包，并该NIC根据该目的VM对应的队列的队列信息，从该目的VM对应的NIC端口转发该第一数据包至该目的VM。
如图5c，该虚拟交换机与该NIC通过至少n个队列通信，n为该主机上运行的VM的数量，每一个队列与一个VM对应。该虚拟交换机将该第一数据包与该虚拟交换机可访问流表集合中的该数据流对应的流表进行匹配，获取该数据流的数据包的路由信息后，例如为VS端口1，而VS端口1对应VM1且VM1对应于队列1，则该虚拟机交换机将该第一数据包发送至队列1。
该NIC从队列1获取该第一数据包，该主机上运行的NIC驱动向该NIC发送队列信息，该队列信息用于通知该NIC该第一数据包来自队列1。由于队列1与VM1的对应，同时VM1与NIC端口1对应，则该NIC通过NIC端口1将该第一数据包发送至VM1。此种方式要求NIC存储有队列与NIC端口的对应关系。这种实施方式与前述两种可选方案相比，虚拟交换机和NIC均无需将该数据流的数据包的路由信息转换为NIC端口标识，提升了数据包的转发效率。
实际的SDN中，VM一般设有安全组，因此在这三种可选方案中确认了该第一数据包的目的VM后，可选的，还需要确认该第一数据包通过安全组检查后， 才将该第一数据包发送至该第一数据包的目的VM。
可选的，若设置有静态安全组，首先确定该第一数据包的目的VM是否属于某一静态安全组，若确定该第一数据包的目的VM属于某一静态安全组，则判断该第一数据包能否匹配上该静态安全组的任一规则，若该第一数据包能够匹配上该静态安全组的至少一条规则，则该第一数据包通过静态安全组检查。若该第一数据包的目的VM不属于任一静态安全组，则无需对该第一数据包进行静态安全组检查，根据第一预设规则直接对该第一数据包进行处理，例如将该第一数据包发送至该第一数据包的目的VM。若该第一数据包的目的VM属于某一静态安全组，但该第一数据包无法匹配该静态安全组的任一规则，则该第一数据包无法通过安全组检查，根据第二预设规则处理该第一数据包，例如丢弃该第一数据包。
以上为设置有白名单的静态安全组的场景，如果设置的为黑名单的静态安全组，与白名单的场景相反，如果该第一数据包属于某一静态安全组但无法匹配该静态安全组的任一规则，则该第一数据包通过静态安全组检查。而如果该第一数据包的目的VM属于某一静态安全组，且该第一数据包可以匹配该静态安全组的至少一条规则，则该第一数据包无法通过静态安全组检查。
可选的，若设置有动态安全组，则首先判断该第一数据包的目的VM是否属于动态安全组，如果该目的VM属于动态安全组，则根据该第一数据包查询连接跟踪表(英文全称：connection track table)，确认该第一数据包属于哪个连接，并确定该第一数据包该连接的状态以及该第一数据包对应的处理动作，如果该第一数据包的处理动作指示转发该第一数据包至该第一数据包的目的VM，则该第一数据包通过动态安全组检查。
以上静态安全组和动态安全组可以同时设置，此时通过静态安全组检查和动态安全组检查的数据包才通过了安全组检查。步骤416后采用步骤4182至步骤4184或步骤4185至步骤4186的情况下，安全组检查可以由主机上运行的安全组模块实现，因此如果安全组模块确认该第一数据包无法通过安全组检查，则无需将该第一数据包发送至该NIC，提升了NIC的工作效率。而步骤416后采用步骤4181的情况下，对于发送至虚拟交换机的数据包的安全组检查可以在数据包发送 回NIC后，由NIC执行。
步骤420，该NIC根据匹配上的流表中包括的路由信息，转发该第一数据包到该第一数据包的目的VM。
该NIC根据该第一数据包的匹配信息，在该NIC可访问流表集合中匹配上该第一数据包所在数据流对应的流表，根据该流表包括的该数据流的数据包的路由信息转发该第一数据包到该第一数据包的目的VM。
由于步骤412中，该NIC能够将该第一数据包匹配上NIC可访问流表集合中的流表，因此该第一数据包不是所在数据流的首个数据包。
步骤420中，该NIC根据匹配上的流表中包括的路由信息后，参照前述安全组检查过程，可选的，该NIC确认该第一数据包通过安全组检查后，才将该第一数据包发送至该第一数据包的目的VM。
步骤4181或步骤4184或步骤4186或步骤420之后，该NIC继续接收该数据流的后续数据包的情况下，例如第二overlay数据包，该第二overlay数据包包括第二数据包和第二数据包对应的第二overlay头，如果该数据流对应的流表仍存储于NIC可访问流表集合中，则NIC根据该数据流的数据包的路由信息转发该第二数据包到该目的VM。而实际中由于NIC可访问流表集合中的流表可能随着时间更新，因此虽然在步骤416中该数据流对应的流表被加入到该NIC可访问流表集合，但NIC根据该第二数据包的匹配信息无法匹配NIC可访问流表集合中的任一流表，这种情况下对该后续数据包执行步骤414、步骤416、步骤4181或步骤4182至步骤4184或步骤4185至步骤4186。
该数据包处理方法，将数据包与流表的匹配功能卸载至NIC上执行，降低了虚拟交换机的工作负担，使得主机的硬件层资源可以更好的服务于VM，提升了计算设备的工作效率。
参考图5d，为本申请提供的另一计算设备的结构示意图，与图5a、图5b或图5c不同，该计算设备中VM-1至VM-n连接于NIC，VM-n+1至VM-n+m连接于虚拟交换机。VM-n+1至VM-n+m可以在执行图4中虚拟交换机和该NIC的配置过程之前就已经配置完毕，或在图4的虚拟交换机和该NIC的配置过程中，有选择的将 VM-n+1至VM-n+m连接于虚拟交换机，将VM-1至VM-n连接于NIC，具体可以依据主机的负载情况或根据主机接收到的配置信息中携带的信息来配置一部分VM连接于NIC，其余部分VM连接于虚拟交换机。
图5d的场景下，NIC接收到外部网络发来的数据包的情况下，如果该数据包的目的VM连接于该NIC，则对该数据包执行前述图4中的数据包处理方法，如果该数据包的目的VM连接于该虚拟交换机，则该NIC直接将该数据包发送至该虚拟交换机。由该虚拟交换机完成该数据包的流表匹配，并将该数据包发送至其目的VM。具体的，可以通过流表的设置使得该NIC实现上述功能。例如，目的VM连接于该虚拟交换机的数据包所在数据流对应的流表，不会被存入NIC可访问流表集合，则该NIC接收到目的VM连接于该虚拟交换机的数据包时，无法在NIC可访问流表集合中匹配上流表，则会将该数据包发送至该虚拟交换机；或修改目的VM连接于该虚拟交换机的数据包所在数据流对应的流表后，再将该流表存入NIC可访问流表集合，对该流表的修改包括将该流表的路由信息修改为主机端口，则该NIC接收到目的VM连接于该虚拟交换机的数据包时，在NIC可访问流表集合中匹配上的流表指示将该数据包通过主机端口发送至该虚拟交换机。
本申请还提供了一种NIC600，该NIC600可以为前述任一附图提供的NIC。该NIC600的组织结构示意图如图6a所示，包括主机接口602，网络接口604以及处理芯片606。网络接口604用于与外部网络通信且网络接口604与处理芯片606建立通信连接。主机接口602用于与NIC600所连接的主机上运行的虚拟交换机、VM、NIC驱动等通信且主机接口602与处理芯片606建立通信连接。前述数据包处理方法中，NIC上建立的NIC端口与主机端口为虚拟端口，主机端口与NIC端口实际通过主机接口602实现与主机的通信。参考图3，主机接口602实际可以为NIC600与计算设备的总线连接的接口。
主机接口602，用于从该NIC连接的主机获取虚拟交换机端口的配置信息。将该虚拟交换机端口的配置信息发送至处理芯片606。
处理芯片606，用于根据该虚拟交换机端口的配置信息将NIC600与该主机上运行的VM连接。
具体的，参考前述步骤406，处理芯片606根据该虚拟交换机端口的配置信息在该NIC上配置至少一个NIC端口，每个NIC端口对应该主机上运行的一个VM。
以上为NIC600的配置过程中NIC600中各个单元的功能，NIC600还可以用于数据包的处理，参考前述数据包处理方法中的步骤408及其步骤408之后的步骤。
网络接口604，还用于接收第一overlay类型数据包，参考步骤408。
网络接口604将接收到的该第一overlay类型数据包发送至处理芯片606。
处理芯片606，还用于接收到该第一overlay类型数据包后，对该第一overlay类型数据包的处理参考前述步骤410、步骤412。
处理芯片606，还用于执行步骤412。在步骤412中确定该第一数据包无法匹配NIC可访问流表集合中的任一流表的情况下，执行步骤414及后续步骤。在步骤412中确定该第一数据包能够匹配NIC可访问流表集合中的流表的情况下，执行步骤420。
步骤414后，处理芯片606执行三种可选方案之任一，这三种可选方案分别对应于前述步骤4181、步骤4182至步骤4184中NIC侧执行的部分、步骤4185至步骤4186中NIC侧执行的部分。
可选方案一，对应前述步骤4181，处理芯片606根据该第一数据包的匹配信息查询该NIC可访问流表集合，获取该第一数据包所在的数据流对应的流表，也即获取该数据流的数据包的路由信息包括的VS端口标识，将VS端口标识转换为NIC端口标识。
可选方案二，对应前述步骤4182至步骤4184中NIC侧执行的部分。处理芯片606接收该返回的第一数据包，处理芯片606根据该返回的第一数据包中携带的端口标识获取NIC端口标识。如果该端口标识为虚拟交换机端口标识，则处理芯片606将该虚拟交换机端口标识转换为NIC端口标识。该端口标识也可能为NIC端口标识。
可选方案三，对应前述步骤4185至步骤4186中NIC侧执行的部分。处理芯片606从n个队列中的一个队列接收该第一数据包，由于处理芯片606预先配置有每个队列与NIC端口的对应关系，因此处理芯片606可以获得接收该第一数据包的队列对应的NIC端口标识。
处理芯片606执行步骤412，并确定该第一数据包能够匹配NIC可访问流表集合中的流表的情况下，获取匹配上的流表中包括的该数据流的数据包的路由信息。该数据流的数据包的路由信息可以包括VS端口标识，处理芯片606将VS端口标识转换为NIC端口标识。
处理芯片606执行步骤412后，无论在该第一数据包能否匹配NIC可访问流表集合中的流表的情况下，均会获取该第一数据包对应的NIC端口标识，该NIC端口标识对应于该第一数据包所在数据流的目的VM。处理芯片606确定该第一数据包的目的VM后，还用于对该第一数据包进行安全组检查。处理芯片606在确定该第一数据包的安全组检查通过之后，通过主机接口602将该第一数据包到该目的VM。具体的处理芯片606对该第一数据包进行安全组检查的过程，参考前述数据包处理方法。
需要说明的是，如果网络接口604接收的不是overlay类型数据包，则处理芯片606无须执行步骤410。
以上提供的NIC实现了流表匹配功能，对于在NIC可访问流表集合中的数据包，将无需发送至虚拟交换机进行处理，降低了主机的负荷，提升了与该NIC相连的主机的工作效率。
处理芯片606可以通过专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)实现，或可编程逻辑器件(英文：programmable logic device，缩写：PLD)实现。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程门阵列(英文：field programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。
具体的，如图6b所示，处理芯片606可以包括overlay芯片6062、流表匹配芯片6064以及安全组检查芯片6066。其中，overlay芯片6062用于将网络接口804发送至处理芯片606的overlay类型数据包的overlay头剥离。流表匹配芯片6064用于将剥离了overlay头的数据包与存储于NIC可访问流表集合中的流表进行匹配。安全组检查芯片6066用于确定在流表匹配芯片8064中匹配上流表的数据包是否通过安 全组检查，并将通过安全组检查的数据包通过主机接口602发送至目的VM。Overlay芯片6062与安全组检查芯片6066为可选组件。
处理芯片606还可以通过处理器、存储设备以及逻辑芯片实现，该逻辑芯片可以由PLD或ASIC实现。该处理芯片606运行时，该处理器和该逻辑芯片各执行一部分功能，两者功能的分配可以有多种。示例性的，如图6c所示，逻辑芯片用于将网络接口604发送至处理芯片606的overlay类型数据包的overlay头剥离。处理芯片606内的处理器工作时，读取存储器内的代码，用于读取NIC可访问流表集合中的流表，并将NIC可访问流表集合中的流表发送至逻辑芯片，以供逻辑芯片将剥离了overlay头的数据包与该流表进行匹配。处理器还用于读取进行安全组检查所需的信息，并将安全组检查所需的信息发送至逻辑芯片，以供逻辑芯片对该数据包进行安全组检查。
在图6c所示的NIC600的处理芯片606中，逻辑芯片也可以由overlay子芯片、流表匹配子芯片、安全组检查子芯片构成。overlay子芯片、安全组检查子芯片为可选组件。overlay子芯片用于将overlay类型数据包的overlay头剥离。图6c所示的NIC600的处理芯片606中处理器用于获取流表匹配或安全组检查所需的信息并将流表匹配或安全组检查所需的信息发送至该逻辑芯片，而流表匹配子芯片根据流表匹配所需的信息完成数据包的流表匹配，安全组检查子芯片根据安全组检查所需的信息完成数据包的安全组检查。
本申请还提供了一种数据包处理方法，前述任一附图中的NIC运行时执行该方法。该方法具体参考图4对应的数据包处理方法中NIC侧执行的部分。
本申请还提供了一种配置方法，前述任一附图中的主机运行时执行该方法。该方法具体参考图4对应的数据包处理方法中的步骤402和步骤404。
本申请还提供了一种数据包处理方法，前述任一附图中主机运行时执行该方法。该方法具体参考图4对应的数据包处理方法中的步骤408后主机侧执行的方法。具体包括，步骤416、步骤4181中将该数据流对应的流表存储到NIC可访问流表集合后向该NIC发送通知消息的部分，或步骤4182和步骤4183，或步骤4185。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
结合本申请公开内容所描述的方法可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM、快闪存储器、ROM、可擦除可编程只读存储器(英文：erasable programmable read only memory，缩写：EPROM)、电可擦可编程只读存储器(英文：electrically erasable programmable read only memory，缩写：EEPROM)、硬盘、光盘或者本领域熟知的任何其它形式的存储介质中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件或软件来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上该的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上该仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、改进等，均应包括在本申请的保护范围之内。

Claims (35)

  1. 一种数据包处理方法，其特征在于，所述方法应用于计算设备，所述计算设备包括网络接口卡NIC和主机，所述NIC与所述主机建立通信连接，所述主机运行虚拟机VM，所述方法包括：
    所述NIC接收数据流的第一数据包；
    所述NIC根据所述第一数据包的匹配信息查询流表集合；
    在无法匹配到所述数据流对应的流表情况下，所述NIC向所述主机上运行的虚拟交换机转发所述第一数据包；
    其中，所述虚拟交换机在接收到所述第一数据包后，从软件定义网络SDN控制器获取所述数据流对应的流表，以便于所述数据流对应的流表被加入到所述流表集合。
  2. 如权利要求1所述的数据包处理方法，其特征在于，所述主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应所述主机上运行的一个VM，所述NIC接收所述第一数据包前，所述方法还包括：
    所述NIC接收所述虚拟交换机端口的配置信息；
    所述NIC根据所述虚拟交换机端口的配置信息，在所述NIC上配置至少一个NIC端口，每个NIC端口通过单根-输入/输出虚拟化SR-I/OV技术与所述主机上运行的一个VM连接。
  3. 如权利要求2所述的数据包处理方法，其特征在于，所述数据流对应的流表包括所述数据流的数据包的路由信息，在向所述虚拟交换机转发所述第一数据包之后，所述方法还包括：
    所述NIC根据所述第一数据包的匹配信息查询所述流表集合，获取所述数据流对应的流表，并根据所述数据流的数据包的路由信息转发所述第一数据包至目的VM。
  4. 如权利要求2所述的数据包处理方法，其特征在于，所述数据流对应的流表包括所述数据流的数据包的路由信息，在向所述虚拟交换机转发所述第一数据包之后，所述方法还包括：
    所述NIC接收所述虚拟交换机返回的第一数据包，所述返回的第一数据包中 包含对应于目的VM的端口标识，所述端口标识为虚拟交换机端口标识或NIC端口标识，所述端口标识由所述虚拟交换机根据所述数据流的数据包的路由信息添加；
    所述NIC根据所述端口标识，转发所述第一数据包到所述目的VM。
  5. 如权利要求2所述的数据包处理方法，其特征在于，所述虚拟交换机与所述NIC通过至少一个队列通信，每个队列对应所述主机上运行的一个VM；
    在向所述虚拟交换机转发所述第一数据包之后，所述方法还包括：
    所述NIC从所述第一数据包的目的VM对应的队列接收所述第一数据包；
    所述NIC根据所述目的VM对应的队列的队列信息，从所述目的VM对应的NIC端口转发所述第一数据包至所述目的VM。
  6. 一种网络接口卡NIC，其特征在于，所述NIC包括：主机接口、网络接口和处理芯片，所述网络接口用于与外部网络通信且所述网络接口与所述处理芯片建立通信连接，所述主机接口用于与主机通信且所述主机接口与所述处理芯片建立通信连接，所述主机运行VM；
    所述网络接口，用于接收数据流的第一数据包；
    所述处理芯片，用于根据所述第一数据包的匹配信息查询流表集合，在无法匹配到所述数据流对应的流表情况下，通过所述主机接口向所述主机上运行的虚拟交换机转发所述第一数据包；
    其中，所述虚拟交换机在接收到所述第一数据包后，从软件定义网络SDN控制器获取所述数据流对应的流表，以便于所述数据流对应的流表被加入到所述流表集合。
  7. 如权利要求6所述的NIC，其特征在于，所述主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应所述主机上运行的一个VM；
    所述处理芯片，还用于接收所述虚拟交换机端口的配置信息，根据所述虚拟交换机端口的配置信息，在所述NIC上配置至少一个NIC端口，每个NIC端口 通过单根-输入/输出虚拟化SR-I/OV技术与所述主机上运行的一个VM连接。
  8. 如权利要求7所述的NIC，其特征在于，所述处理芯片，还用于根据所述第一数据包的匹配信息查询所述流表集合，获取所述数据流对应的流表，所述数据流对应的流表包括所述数据流的数据包的路由信息，并根据所述数据流的数据包的路由信息转发所述第一数据包至目的VM。
  9. 如权利要求7所述的NIC，其特征在于，所述处理芯片，还用于接收所述虚拟交换机返回的第一数据包，所述返回的第一数据包中包含对应于目的VM的端口标识，所述端口标识为虚拟交换机端口标识或NIC端口标识，所述端口标识由所述虚拟交换机根据所述数据流的数据包的路由信息添加，所述数据流对应的流表包括所述数据流的数据包的路由信息；还用于根据所述端口标识，转发所述第一数据包到所述目的VM。
  10. 如权利要求7所述的NIC，其特征在于，所述虚拟交换机与所述NIC通过至少一个队列通信，每个队列对应所述主机上运行的一个VM；
    所述处理芯片，还用于从所述第一数据包的目的VM对应的队列接收所述第二数据包，并根据所述目的VM对应的队列的队列信息，从所述目的VM对应的NIC端口转发所述第二数据包至所述目的VM。
  11. 一种数据包处理方法，其特征在于，所述方法应用于计算设备，所述计算设备包括网络接口卡NIC和主机，所述NIC与所述主机建立通信连接，所述主机运行虚拟机VM，所述方法包括：
    所述NIC接收数据流的第二数据包；
    所述NIC根据所述第二数据包的匹配信息查询流表集合，获取所述数据流对应的流表，所述数据流对应的流表包括所述数据流的数据包的路由信息；
    所述NIC根据所述数据流的数据包的路由信息，转发所述第二数据包到目的VM。
  12. 如权利要求11所述的数据包处理方法，其特征在于，所述NIC通过单根-输入/输出虚拟化SR-I/OV技术与所述主机上运行的VM连接；
    所述NIC根据所述数据流的数据包的路由信息，通过所述NIC与所述目的 VM的连接转发所述第二数据包到所述目的VM。
  13. 如权利要求12所述的数据包处理方法，所述主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应所述主机上运行的一个VM；
    所述NIC接收数据流的第二数据包前，所述方法还包括：
    所述NIC接收所述虚拟交换机端口的配置信息；
    根据所述虚拟交换机端口的配置信息，在所述NIC上配置至少一个NIC端口，每个NIC端口通过单根-输入/输出虚拟化SR-I/OV技术与所述主机上运行的一个VM连接，所述数据流的数据包的路由信息指示所述目的VM对应的NIC端口。
  14. 如权利要求13所述的数据包处理方法，其特征在于，所述NIC接收数据流的第二数据包前，所述方法还包括：
    所述NIC接收所述数据流的第三数据包；
    所述NIC根据所述第三数据包的匹配信息查询所述流表集合；
    在无法匹配到所述数据流对应的流表情况下，所述NIC向所述主机上运行的虚拟交换机转发所述第三数据包；
    其中，所述虚拟交换机在接收到所述第三数据包后，从软件定义网络SDN控制器获取所述数据流对应的流表，以便于所述数据流对应的流表被加入到所述流表集合。
  15. 如权利要求14所述的数据包处理方法，其特征在于，在向所述虚拟交换机转发所述第三数据包之后，所述方法还包括：
    所述NIC根据所述第三数据包的匹配信息查询所述流表集合，获取所述数据流对应的流表，并根据所述数据流的数据包的路由信息转发所述第三数据包至所述目的VM。
  16. 如权利要求14所述的数据包处理方法，其特征在于，在向所述虚拟交换机转发所述第三数据包之后，所述方法还包括：
    所述NIC接收所述虚拟交换机返回的第三数据包，所述返回的第三数据包中包含对应于所述目的VM的端口标识，所述端口标识为虚拟交换机端口标识或 NIC端口标识，所述端口标识由所述虚拟交换机根据所述数据流的数据包的路由信息添加；
    所述NIC根据所述端口标识，转发所述第三数据包到所述目的VM。
  17. 如权利要求14所述的数据包处理方法，其特征在于，所述虚拟交换机与所述NIC通过至少一个队列通信，每个队列对应所述主机上运行的一个VM；
    在向所述虚拟交换机转发所述第三数据包之后，所述方法还包括：
    所述NIC从所述目的VM对应的队列接收所述第三数据包；
    所述NIC根据所述目的VM对应的队列的队列信息，从所述目的VM对应的NIC端口转发所述第三数据包至所述目的VM。
  18. 如权利要求11至17任一所述的数据包处理方法，其特征在于，所述NIC接收数据流的第二数据包包括：
    所述NIC接收overlay类型数据包，所述overlay类型数据包包括overlay头和所述第二数据包，所述overlay头包括虚拟可扩展局域网VXLAN头，或使用通用路由的网络虚拟化NVGRE头，或无状态传输隧道STT头；
    所述NIC剥去所述overlay类型数据包的overlay头，获取所述第二数据包。
  19. 如权利要求11至18任一所述的数据包处理方法，其特征在于，所述NIC转发所述第二数据包到目的VM之前，所述方法还包括：
    所述NIC对所述第二数据包进行安全组检查，在确定所述第二数据包的安全组检查通过之后，执行转发所述第二数据包到所述目的VM的步骤。
  20. 一种网络接口卡NIC，其特征在于，所述NIC包括：主机接口、网络接口和处理芯片，所述网络接口用于与外部网络通信且所述网络接口与所述处理芯片建立通信连接，所述主机接口用于与主机通信且所述主机接口与所述处理芯片建立通信连接，所述主机运行VM；
    所述网络接口，用于接收数据流的第二数据包；
    所述处理芯片，用于根据所述第二数据包的匹配信息查询流表集合，获取所述数据流对应的流表，所述数据流对应的流表包括所述数据流的数据包的路 由信息；以及根据所述数据流的数据包的路由信息，转发所述第二数据包到目的VM。
  21. 如权利要求20所述的NIC，其特征在于，所述NIC通过单根-输入/输出虚拟化SR-I/OV技术与所述主机上运行的VM连接；
    所述处理芯片，用于根据所述数据流的数据包的路由信息，通过所述NIC与所述目的VM的连接转发所述第二数据包到所述目的VM。
  22. 如权利要求21所述的NIC，其特征在于，所述主机上运行的虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应所述主机上运行的一个VM；
    所述处理芯片，还用于接收所述虚拟交换机端口的配置信息，根据所述虚拟交换机端口的配置信息在所述NIC上配置至少一个NIC端口，每个NIC端口通过单根-输入/输出虚拟化SR-I/OV技术与所述主机上运行的一个VM连接，所述数据流的数据包的路由信息指示所述目的VM对应的NIC端口。
  23. 如权利要求22所述的NIC，其特征在于，所述网络接口，还用于接收所述数据流的第三数据包；
    所述处理芯片，还用于根据所述第三数据包的匹配信息查询所述流表集合，在无法匹配到所述数据流对应的流表情况下，向所述主机上运行的虚拟交换机转发所述第三数据包；
    其中，所述虚拟交换机在接收到所述第三数据包后，从软件定义网络SDN控制器获取所述数据流对应的流表，以便于所述数据流对应的流表被加入到所述流表集合。
  24. 如权利要求23所述的NIC，其特征在于，所述处理芯片，还用于根据所述第三数据包的匹配信息查询所述流表集合，获取所述数据流对应的流表，并根据所述数据流的数据包的路由信息转发所述第三数据包至所述目的VM。
  25. 如权利要求23所述的NIC，其特征在于，所述处理芯片，还用于接收所述虚拟交换机返回的第三数据包，所述返回的第三数据包中包含对应于所述目的VM的端口标识，所述端口标识为虚拟交换机端口标识或NIC端口标识，所述端口标识由所述虚拟交换机根据所述数据流的数据包的路由信息添加；还用于 根据所述端口标识，转发所述第三数据包到所述目的VM。
  26. 如权利要求23所述的NIC，其特征在于，所述虚拟交换机与所述NIC通过至少一个队列通信，每个队列对应所述主机上运行的一个VM；
    所述处理芯片，还用于从所述目的VM对应的队列接收所述第三数据包，并根据所述目的VM对应的队列的队列信息，从所述目的VM对应的NIC端口转发所述第三数据包至所述目的VM。
  27. 如权利要求20至26任一所述的NIC，其特征在于，所述网络接口，用于接收overlay类型数据包，所述overlay类型数据包包括overlay头和所述第二数据包，所述overlay头包括虚拟可扩展局域网VXLAN头，或使用通用路由的网络虚拟化NVGRE头，或无状态传输隧道STT头；
    所述处理芯片，用于剥去所述overlay类型数据包的overlay头，获取所述第二数据包。
  28. 如权利要求20至27任一所述的NIC，其特征在于，所述处理芯片转发所述第二数据包到所述目的VM之前，还用于对所述第二数据包进行安全组检查，在确定所述第二数据包的安全组检查通过之后，执行转发所述第二数据包到所述目的VM的步骤。
  29. 一种计算设备，其特征在于，所述计算设备包括网络接口卡NIC和主机，所述NIC与所述主机建立通信连接，所述主机上运行虚拟机VM和虚拟交换机，所述虚拟交换机上配置至少一个虚拟交换机端口，每个虚拟交换机端口对应所述主机上运行的一个VM；
    所述主机，用于向所述NIC发送所述虚拟交换机端口的配置信息；
    所述NIC，用于根据所述虚拟交换机端口的配置信息，在所述NIC上配置至少一个NIC端口，每个NIC端口通过单根-输入/输出虚拟化SR-I/OV技术与所述主机上运行的一个VM连接；
    所述NIC，还用于接收数据流的第二数据包，根据所述第二数据包的匹配信息查询流表集合，获取所述数据流对应的流表，所述数据流对应的流表包括所述数据流的数据包的路由信息，所述数据流的数据包的路由信息指示目的VM对 应的NIC端口，以及根据所述数据流的数据包的路由信息，转发所述第二数据包到所述目的VM。
  30. 如权利要求29所述的计算设备，其特征在于，所述NIC，还用于接收所述数据流的第三数据包，根据所述第三数据包的匹配信息查询所述流表集合，在无法匹配到所述数据流对应的流表情况下，向所述主机转发所述第三数据包；
    所述主机，用于在接收到所述第三数据包后，从软件定义网络SDN控制器获取所述数据流对应的流表，以便于所述数据流对应的流表被加入到所述流表集合。
  31. 如权利要求30所述的计算设备，其特征在于，所述NIC，还用于根据所述第三数据包的匹配信息查询所述流表集合，获取所述数据流对应的流表，以及根据所述数据流的数据包的路由信息转发所述第三数据包至所述目的VM。
  32. 如权利要求30所述的计算设备，其特征在于，所述主机，还用于生成返回的第三数据包，所述返回的第三数据包中包含对应于所述目的VM的端口标识，所述端口标识为虚拟交换机端口标识或NIC端口标识，所述端口标识由所述主机根据所述数据流的数据包的路由信息添加；
    所述NIC，还用于接收所述返回的第三数据包，并根据所述端口标识，转发所述第三数据包到所述目的VM。
  33. 如权利要求30所述的计算设备，其特征在于，所述虚拟交换机与所述NIC通过至少一个队列通信，每个队列对应所述主机上运行的一个VM；
    所述主机，还用于将所述第三数据包发送至所述目的VM对应的队列；
    所述NIC，还用于从所述目的VM对应的队列接收所述第三数据包，以及根据所述目的VM对应的队列的队列信息，从所述目的VM对应的NIC端口转发所述第三数据包至所述目的VM。
  34. 如权利要求29至33任一所述的计算设备，其特征在于，所述NIC，具体用于接收overlay类型数据包，所述overlay类型数据包包括overlay头和所述第二数据包，所述overlay头包括虚拟可扩展局域网VXLAN头，或使用通用路由的网络虚拟化NVGRE头，或无状态传输隧道STT头；还用于剥去所述overlay类型数据包的overlay头，获取所述第二数据包。
  35. 如权利要求29至34任一所述的计算设备，其特征在于，所述NIC转发所述第二数据包到目的VM之前，还用于对所述第二数据包进行安全组检查，在确定所述第二数据包的安全组检查通过之后，执行转发所述第二数据包到所述目的VM的步骤。
PCT/CN2016/093098 2016-08-03 2016-08-03 网络接口卡、计算设备以及数据包处理方法 Ceased WO2018023499A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
EP16911096.2A EP3340064B1 (en) 2016-08-03 2016-08-03 Network interface card, computer device and data packet processing method
CN201680084595.0A CN109074330B (zh) 2016-08-03 2016-08-03 网络接口卡、计算设备以及数据包处理方法
PCT/CN2016/093098 WO2018023499A1 (zh) 2016-08-03 2016-08-03 网络接口卡、计算设备以及数据包处理方法
US15/927,005 US10581729B2 (en) 2016-08-03 2018-03-20 Network interface card, computing device, and data packet processing method
US16/796,028 US20200204486A1 (en) 2016-08-03 2020-02-20 Network interface card, computing device, and data packet processing method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/093098 WO2018023499A1 (zh) 2016-08-03 2016-08-03 网络接口卡、计算设备以及数据包处理方法

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/927,005 Continuation US10581729B2 (en) 2016-08-03 2018-03-20 Network interface card, computing device, and data packet processing method

Publications (1)

Publication Number Publication Date
WO2018023499A1 true WO2018023499A1 (zh) 2018-02-08

Family

ID=61072571

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/093098 Ceased WO2018023499A1 (zh) 2016-08-03 2016-08-03 网络接口卡、计算设备以及数据包处理方法

Country Status (4)

Country Link
US (2) US10581729B2 (zh)
EP (1) EP3340064B1 (zh)
CN (1) CN109074330B (zh)
WO (1) WO2018023499A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110912825A (zh) * 2018-09-18 2020-03-24 阿里巴巴集团控股有限公司 一种报文的转发方法、装置、设备及系统
US11223579B2 (en) 2017-06-30 2022-01-11 Huawei Technologies Co., Ltd. Data processing method, network interface card, and server
US11240148B2 (en) 2017-12-26 2022-02-01 Huawei Technologies Co., Ltd. Packet processing method and apparatus
CN114726930A (zh) * 2022-03-30 2022-07-08 深信服科技股份有限公司 一种数据包跟踪方法、系统、装置及可读存储介质
CN115022217A (zh) * 2022-06-14 2022-09-06 深信服科技股份有限公司 一种网卡检测方法、装置及电子设备和存储介质
US11496393B2 (en) 2018-03-31 2022-11-08 Huawei Technologies Co., Ltd. Method and apparatus for forwarding packet based on integrated flow table

Families Citing this family (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IL238690B (en) 2015-05-07 2019-07-31 Mellanox Technologies Ltd Network-based computational accelerator
US10749808B1 (en) 2015-06-10 2020-08-18 Amazon Technologies, Inc. Network flow management for isolated virtual networks
EP3340547B1 (en) 2016-08-03 2019-11-27 Huawei Technologies Co., Ltd. Network interface card and data packet processing method
EP3340064B1 (en) * 2016-08-03 2020-12-02 Huawei Technologies Co., Ltd. Network interface card, computer device and data packet processing method
US20190044809A1 (en) 2017-08-30 2019-02-07 Intel Corporation Technologies for managing a flexible host interface of a network interface controller
US10382350B2 (en) * 2017-09-12 2019-08-13 Mellanox Technologies, Ltd. Maintaining packet order in offload of packet processing functions
US11469953B2 (en) 2017-09-27 2022-10-11 Intel Corporation Interworking of legacy appliances in virtualized networks
US11502948B2 (en) 2017-10-16 2022-11-15 Mellanox Technologies, Ltd. Computational accelerator for storage operations
US11005771B2 (en) 2017-10-16 2021-05-11 Mellanox Technologies, Ltd. Computational accelerator for packet payload operations
CN116260776A (zh) * 2017-10-24 2023-06-13 英特尔公司 硬件辅助的虚拟交换机
US10841243B2 (en) 2017-11-08 2020-11-17 Mellanox Technologies, Ltd. NIC with programmable pipeline
US10708240B2 (en) 2017-12-14 2020-07-07 Mellanox Technologies, Ltd. Offloading communication security operations to a network interface controller
US10785020B2 (en) * 2018-01-19 2020-09-22 Microsoft Technology Licensing, Llc Hardware offload for QUIC connections
US11108687B1 (en) 2018-09-12 2021-08-31 Amazon Technologies, Inc. Scalable network function virtualization service
CN112714903B (zh) * 2018-09-19 2024-10-15 亚马逊科技公司 使用客户端提供的决策元数据的基于可缩放小区的包处理服务
US10742446B2 (en) 2018-09-19 2020-08-11 Amazon Technologies, Inc. Interconnecting isolated networks with overlapping address ranges via scalable virtual traffic hubs
US10785146B2 (en) 2018-09-19 2020-09-22 Amazon Technologies, Inc. Scalable cell-based packet processing service using client-provided decision metadata
US10834044B2 (en) 2018-09-19 2020-11-10 Amazon Technologies, Inc. Domain name system operations implemented using scalable virtual traffic hub
US10897417B2 (en) 2018-09-19 2021-01-19 Amazon Technologies, Inc. Automated route propagation among networks attached to scalable virtual traffic hubs
US10797989B2 (en) 2018-09-19 2020-10-06 Amazon Technologies, Inc. Scalable virtual traffic hub interconnecting isolated networks
US10824469B2 (en) 2018-11-28 2020-11-03 Mellanox Technologies, Ltd. Reordering avoidance for flows during transition between slow-path handling and fast-path handling
CN111404705B (zh) * 2019-01-02 2023-05-09 中国移动通信有限公司研究院 一种sdn的优化方法、装置及计算机可读存储介质
US11283732B2 (en) * 2019-03-29 2022-03-22 Juniper Networks, Inc. Network functions virtualization (NFV) backplane on forwarding microchip
US11184439B2 (en) 2019-04-01 2021-11-23 Mellanox Technologies, Ltd. Communication with accelerator via RDMA-based network adapter
CN111865801B (zh) * 2019-04-24 2021-10-22 厦门网宿有限公司 一种基于Virtio端口传输数据的方法和系统
CN112019431B (zh) * 2019-05-29 2023-04-18 阿里巴巴集团控股有限公司 一种转发规则的处理方法、装置及设备
CN114095153B (zh) 2020-08-05 2024-12-17 迈络思科技有限公司 密码数据通信装置
IL276538B2 (en) 2020-08-05 2023-08-01 Mellanox Technologies Ltd A cryptographic device for data communication
CN114363256B (zh) * 2020-09-28 2024-10-18 华为云计算技术有限公司 基于网卡的报文解析方法以及相关装置
US11934658B2 (en) 2021-03-25 2024-03-19 Mellanox Technologies, Ltd. Enhanced storage protocol emulation in a peripheral device
US11934333B2 (en) 2021-03-25 2024-03-19 Mellanox Technologies, Ltd. Storage protocol emulation in a peripheral device
US12236250B2 (en) 2021-12-03 2025-02-25 Samsung Electronics Co., Ltd. Systems and methods for verifying program states
US12229578B2 (en) * 2021-12-22 2025-02-18 VMware LLC Teaming of smart NICs
US12117948B2 (en) 2022-10-31 2024-10-15 Mellanox Technologies, Ltd. Data processing unit with transparent root complex
US12007921B2 (en) 2022-11-02 2024-06-11 Mellanox Technologies, Ltd. Programmable user-defined peripheral-bus device implementation using data-plane accelerator (DPA)
US20240179121A1 (en) * 2022-11-30 2024-05-30 Juniper Networks, Inc. Intelligent Firewall Flow Processor
US12452219B2 (en) 2023-06-01 2025-10-21 Mellanox Technologies, Ltd Network device with datagram transport layer security selective software offload
US12547543B2 (en) 2024-07-31 2026-02-10 Mellanox Technologies, Ltd. Cache coherency
CN121056423B (zh) * 2025-11-03 2026-01-27 深圳云豹智能股份有限公司 流表处理方法、装置、芯片、网络接口卡、设备、介质和程序产品

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100135182A1 (en) * 2008-12-02 2010-06-03 Electronics And Telecommunications Research Institute High-speed ip flow mediation apparatus using network processor
CN103346981A (zh) * 2013-06-28 2013-10-09 华为技术有限公司 虚拟交换方法、相关装置和计算机系统
CN103856573A (zh) * 2012-12-04 2014-06-11 华为技术有限公司 一种互联网协议ip地址的配置方法、装置及系统
CN104205080A (zh) * 2012-03-21 2014-12-10 微软公司 为联网设备虚拟化卸载分组处理

Family Cites Families (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8116320B2 (en) 2006-08-07 2012-02-14 Adc Telecommunications, Inc. Mapping external port using virtual local area network
CN101616174B (zh) * 2009-07-09 2012-07-11 浪潮电子信息产业股份有限公司 一种存储系统io处理路径动态跟踪实现优化系统性能的方法
WO2012044700A1 (en) 2010-10-01 2012-04-05 Huawei Technologies Co., Ltd. System and method for controlling the input/output of a virtualized network
US8670450B2 (en) 2011-05-13 2014-03-11 International Business Machines Corporation Efficient software-based private VLAN solution for distributed virtual switches
US8837499B2 (en) * 2011-05-14 2014-09-16 International Business Machines Corporation Distributed fabric protocol (DFP) switching network architecture
CN104067231B (zh) 2011-12-07 2017-03-29 西里克斯系统公司 使用虚拟交换代理控制网络接口
US9225635B2 (en) * 2012-04-10 2015-12-29 International Business Machines Corporation Switch routing table utilizing software defined network (SDN) controller programmed route segregation and prioritization
US9548920B2 (en) 2012-10-15 2017-01-17 Cisco Technology, Inc. System and method for efficient use of flow table space in a network environment
US9008097B2 (en) 2012-12-31 2015-04-14 Mellanox Technologies Ltd. Network interface controller supporting network virtualization
CN203490899U (zh) * 2013-01-05 2014-03-19 刘遥 多屏移动终端
US9210074B2 (en) * 2013-05-03 2015-12-08 Alcatel Lucent Low-cost flow matching in software defined networks without TCAMs
US9426060B2 (en) * 2013-08-07 2016-08-23 International Business Machines Corporation Software defined network (SDN) switch clusters having layer-3 distributed router functionality
CN104468358B (zh) 2013-09-25 2018-05-11 新华三技术有限公司 分布式虚拟交换机系统的报文转发方法及设备
US9596212B2 (en) * 2013-11-11 2017-03-14 The Boeing Company Apparatus, method, and system for hardware-based filtering in a cross-domain infrastructure
US9912582B2 (en) * 2013-11-18 2018-03-06 Telefonaktiebolaget Lm Ericsson (Publ) Multi-tenant isolation in a cloud environment using software defined networking
CN104660574B (zh) 2013-11-22 2018-10-30 华为技术有限公司 数据中心的配置方法、控制实体和转发实体
US9288135B2 (en) 2013-12-13 2016-03-15 International Business Machines Corporation Managing data flows in software-defined network using network interface card
US20150169345A1 (en) * 2013-12-18 2015-06-18 International Business Machines Corporation Software-defined networking (sdn) for management of traffic between virtual processors
CN104731521B (zh) 2013-12-23 2018-02-16 伊姆西公司 用于配置数据中心的方法及设备
CN103916314A (zh) 2013-12-26 2014-07-09 杭州华为数字技术有限公司 报文转发控制方法和相关装置及物理主机
WO2015100656A1 (zh) * 2013-12-31 2015-07-09 华为技术有限公司 一种实现虚拟机通信的方法和装置
CN103873374B (zh) 2014-03-27 2017-08-11 新华三技术有限公司 虚拟化系统中的报文处理方法及装置
US10374972B2 (en) * 2014-05-13 2019-08-06 Telefonaktiebolaget Lm Ericsson (Publ) Virtual flow network in a cloud environment
US9450884B2 (en) * 2014-06-11 2016-09-20 Alcatel-Lucent Software defined networking based congestion control
US9692698B2 (en) * 2014-06-30 2017-06-27 Nicira, Inc. Methods and systems to offload overlay network packet encapsulation to hardware
US9917769B2 (en) * 2014-11-17 2018-03-13 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for virtualizing flow tables in a software-defined networking (SDN) system
JP6424632B2 (ja) 2015-01-08 2018-11-21 富士通株式会社 負荷算出方法、負荷算出プログラム及び負荷算出装置
CN105871663B (zh) * 2015-01-19 2019-04-05 环旭电子股份有限公司 无线以太网络控制方法以及无线以太网络系统
US10061743B2 (en) * 2015-01-27 2018-08-28 International Business Machines Corporation Host based non-volatile memory clustering using network mapped storage
US20170031704A1 (en) * 2015-07-31 2017-02-02 Hewlett-Packard Development Company, L.P. Network port profile for virtual machines using network controller
US10333897B2 (en) * 2015-10-23 2019-06-25 Attala Systems Corporation Distributed firewalls and virtual network services using network packets with security tags
CN105718301B (zh) * 2016-01-15 2018-10-09 浪潮集团有限公司 一种基于vSwitch的虚拟机证书迁移方法
US10230633B2 (en) * 2016-01-21 2019-03-12 Red Hat, Inc. Shared memory communication in software defined networking
CN106155551A (zh) * 2016-06-30 2016-11-23 努比亚技术有限公司 信息处理方法和终端
EP3340547B1 (en) * 2016-08-03 2019-11-27 Huawei Technologies Co., Ltd. Network interface card and data packet processing method
EP3340064B1 (en) * 2016-08-03 2020-12-02 Huawei Technologies Co., Ltd. Network interface card, computer device and data packet processing method

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100135182A1 (en) * 2008-12-02 2010-06-03 Electronics And Telecommunications Research Institute High-speed ip flow mediation apparatus using network processor
CN104205080A (zh) * 2012-03-21 2014-12-10 微软公司 为联网设备虚拟化卸载分组处理
CN103856573A (zh) * 2012-12-04 2014-06-11 华为技术有限公司 一种互联网协议ip地址的配置方法、装置及系统
CN103346981A (zh) * 2013-06-28 2013-10-09 华为技术有限公司 虚拟交换方法、相关装置和计算机系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3340064A4 *

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11223579B2 (en) 2017-06-30 2022-01-11 Huawei Technologies Co., Ltd. Data processing method, network interface card, and server
US11240148B2 (en) 2017-12-26 2022-02-01 Huawei Technologies Co., Ltd. Packet processing method and apparatus
US11792117B2 (en) 2017-12-26 2023-10-17 Huawei Technologies Co., Ltd. Packet processing method and apparatus
US11496393B2 (en) 2018-03-31 2022-11-08 Huawei Technologies Co., Ltd. Method and apparatus for forwarding packet based on integrated flow table
CN110912825A (zh) * 2018-09-18 2020-03-24 阿里巴巴集团控股有限公司 一种报文的转发方法、装置、设备及系统
CN110912825B (zh) * 2018-09-18 2022-08-02 阿里巴巴集团控股有限公司 一种报文的转发方法、装置、设备及系统
US11677686B2 (en) 2018-09-18 2023-06-13 Alibaba Group Holding Limited Packet forwarding method, apparatus, device, and system
CN114726930A (zh) * 2022-03-30 2022-07-08 深信服科技股份有限公司 一种数据包跟踪方法、系统、装置及可读存储介质
CN115022217A (zh) * 2022-06-14 2022-09-06 深信服科技股份有限公司 一种网卡检测方法、装置及电子设备和存储介质

Also Published As

Publication number Publication date
CN109074330A (zh) 2018-12-21
US20180219770A1 (en) 2018-08-02
US20200204486A1 (en) 2020-06-25
EP3340064A1 (en) 2018-06-27
CN109074330B (zh) 2020-12-08
EP3340064A4 (en) 2018-12-26
EP3340064B1 (en) 2020-12-02
US10581729B2 (en) 2020-03-03

Similar Documents

Publication Publication Date Title
CN109074330B (zh) 网络接口卡、计算设备以及数据包处理方法
CN109479028B (zh) 网络接口卡、计算设备以及数据包处理方法
EP4228177B1 (en) Flow table processing method and related device
US10715492B2 (en) Flow table processing method and apparatus
US10649798B2 (en) Virtual switching method, related apparatus, and computer system
EP3671452A1 (en) System and method for user customization and automation of operations on a software-defined network
GB2511435B (en) Virtual network overlays
US9178828B2 (en) Architecture for agentless service insertion
JP5890595B2 (ja) 仮想クラウドインフラストラクチャへの仮想セキュリティ装置アーキテクチャの提供
US9548890B2 (en) Flexible remote direct memory access resource configuration in a network environment
CN105207873A (zh) 一种报文处理方法和装置
US20140280827A1 (en) Scalable distributed control plane for network switching systems
JP2015039166A (ja) 仮想スイッチを有するネットワークインタフェースカードおよびトラフィックフローポリシの適用
US11223597B2 (en) Network and network management method
WO2017113300A1 (zh) 路由确定方法、网络配置方法以及相关装置
US20250141803A1 (en) Cloud System, Packet Processing Method and Apparatus, and Network Interface Card
CN120881030A (zh) 一种报文处理系统以及数据面设备

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2016911096

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE