Method, computer device and medium for virtual function rights management

Abstract

The present application relates to the field of computer technology and provides a method, computer device and medium for virtual function permission management. The method includes: through physical function driving, configuring physical functions and configuring multiple virtual functions that are associated with physical functions, and managing the operation permission configuration of each virtual function, including the first and second virtual functions; through the first virtual machine, at least before the loading of the first virtual function is completed, judging whether the first operation associated with the first virtual function is authorized by the first operation permission configuration, and returning a loading error when it is not authorized; through the first container, at least before the loading of the second virtual function is completed, judging whether the second operation associated with the second virtual function is authorized by the second operation permission configuration, and returning a loading error when it is not authorized. In this way, differentiated permission management and selected message filtering are provided for virtual functions.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, computer device and medium for virtual function permission management. Background Art

[0002] With the application of cloud computing and virtualization technology, cloud vendors use virtual machines, containers and direct access technology to meet the allocation requirements of input and output resources, as well as provide high throughput and low latency. Cloud vendors virtualize physical functions into multiple virtual functions, and then directly access the virtual functions to virtual machines and containers. These physical functions and virtual functions share hardware resources. However, users of virtual machines or containers may have operational errors or malicious attacks, which may affect the normal operation of the network. In the prior art, tunneling technology, such as tunnel messages, is used to isolate network channels of different virtual machines and containers, so as to prevent network channels with operational errors or malicious attacks from affecting the services of other network channels. However, tunneling technology involves the encapsulation, analysis and unpacking of tunnel messages, which occupies additional resources and increases latency, and is too bloated for vendors of small and medium-sized networks. In addition, tunneling technology is difficult to limit user errors or malicious attacks from the root. For example, users of virtual machines or containers may modify machine addresses (MAC addresses) or create a large number of sub-interfaces to seize the table specifications of hardware resources, which are difficult to prevent through tunneling technology.

[0003] To this end, the present application provides a method, computer device and medium for virtual function permission management, which are used to address the technical difficulties in the prior art. Summary of the invention

[0004] In a first aspect, the present application provides a method for virtual function permission management. The method includes: configuring at least one physical function through a physical function driver in the kernel state of a host machine, configuring multiple virtual functions associated with the at least one physical function, and managing the operation permission configuration of each of the multiple virtual functions, wherein the multiple virtual functions include a first virtual function and a second virtual function; obtaining the first operation permission configuration of the first virtual function from the physical function driver through a first virtual machine in the user state of the host machine at least before the first virtual function is loaded, then determining whether the first operation associated with the first virtual function is authorized by the first operation permission configuration, and returning a loading error of the first virtual function when the first operation is not authorized by the first operation permission configuration; obtaining the second operation permission configuration of the second virtual function from the physical function driver through a first container of the host machine at least before the second virtual function is loaded, then determining whether the second operation associated with the second virtual function is authorized by the second operation permission configuration, and returning a loading error of the second virtual function when the second operation is not authorized by the second operation permission configuration.

[0005] Through the first aspect of the present application, differentiated permission management and selected message filtering in virtual function permission management are provided, which is beneficial for cloud vendors to allocate virtual function resources to virtual machines and containers. Tenant resources can be flexibly managed according to the configuration purchased by the tenant, and the negative impact caused by tenant operation errors and malicious attacks can be avoided. It occupies less resources and is friendly to vendors of small and medium-sized networks. It limits user's erroneous operations or malicious attacks from the root, so it supports application scenarios of non-tunnel technology and non-tunnel message filtering. It takes into account the differences between virtual machines and containers, and takes into account the fact that in the application scenario where both virtual machine networks and container networks exist, physical functions and virtual functions cannot see each other's operating systems and file systems. The operation permission configurations of the multiple virtual functions are managed by physical function drivers, so that messages can be transmitted through hardware bus channels to realize the communication mechanism between physical functions and virtual functions.

[0006] In a possible implementation of the first aspect of the present application, the operation permission configuration of each of the multiple virtual functions includes one or more of the following: whether the operation permission to modify the machine address is possessed, whether the operation permission to modify the maximum transmission unit is possessed, whether the operation permission to modify the number of virtual LAN sub-interfaces is possessed, whether the operation permission to turn on and off the source machine address anti-fraud check is possessed, whether the operation permission to configure the downlink bandwidth is possessed, and whether the operation permission to configure the uplink bandwidth is possessed.

[0007] In a possible implementation of the first aspect of the present application, the operation permission configuration of each of the multiple virtual functions includes a virtual file system configuration, and the virtual file system configuration includes a machine address modification permission file, a maximum transmission unit modification permission file, and a virtual LAN sub-interface number configuration permission file.

[0008] In a possible implementation of the first aspect of the present application, the first virtual machine includes a first virtual function driver, which is located in the user state and is used to load the first virtual function and execute the first operation, and the first container includes a second virtual function driver, which is located in the kernel state and is used to load the second virtual function and execute the second operation.

[0009] In a possible implementation of the first aspect of the present application, when the first operation is authorized by the first operation permission configuration, the first virtual function driver executes the first operation, and when the second operation is authorized by the second operation permission configuration, the second virtual function driver executes the second operation.

[0010] In a possible implementation of the first aspect of the present application, the first virtual function driver includes a first sending mailbox and a first receiving mailbox, the second virtual function driver includes a second sending mailbox and a second receiving mailbox, the physical function driver includes a third sending mailbox and a third receiving mailbox, the hardware side of the host machine includes a public mailbox, and the interaction between the first virtual function driver and the physical function driver is realized through the first sending mailbox, the first receiving mailbox, the third sending mailbox, the third receiving mailbox and the public mailbox, and the interaction between the second virtual function driver and the physical function driver is realized through the second sending mailbox, the second receiving mailbox, the third sending mailbox, the third receiving mailbox and the public mailbox.

[0011] In a possible implementation manner of the first aspect of the present application, the interaction between the first virtual function driver and the physical function driver is isolated from the interaction between the second virtual function driver and the physical function driver based on non-tunnel messages.

[0012] In a possible implementation of the first aspect of the present application, the hardware side includes a message security module, which is used to support the physical function driver so as to provide a mirror message filtering function for the interaction between the first virtual function driver and the physical function driver and the interaction between the second virtual function driver and the physical function driver.

[0013] In a possible implementation manner of the first aspect of the present application, the mirrored message filtering function includes a filtering function based on a network protocol address or a machine address.

[0014] In a possible implementation of the first aspect of the present application, the physical function driver is also used to provide a configuration interface, and the configuration interface is used to set the parameters of the mirror message filtering function, and the parameters include one or more of the following: whether it is a layer 2 message, whether there is an inner layer message of a matching tunnel, the source machine address of the layer 2 message, the destination machine address of the layer 2 message, the Ethernet type of the layer 2 message, whether it is a network protocol layer message, the source network protocol address of the network protocol layer message, the destination network protocol address of the network protocol layer message, the protocol number of the network protocol layer message, the source port of the network protocol layer message, the destination port of the network protocol layer message, whether to perform message discarding, and whether to perform message speed limiting.

[0015] In a possible implementation of the first aspect of the present application, the method further includes: uninstalling the first virtual function and notifying the physical function driver through the first virtual machine, and then reclaiming the resources of the first virtual function through the physical function driver; uninstalling the second virtual function and notifying the physical function driver through the first container, and then reclaiming the resources of the second virtual function through the physical function driver.

[0016] In a possible implementation manner of the first aspect of the present application, the physical function driver prevents operation errors and malicious attacks by managing the operation permission configurations of the multiple virtual functions.

[0017] In a second aspect, an embodiment of the present application further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a method according to any one of the implementation modes of any of the above aspects when executing the computer program.

[0018] In a third aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer device, the computer device executes a method according to any one of the implementation methods of any of the above aspects.

[0019] In a fourth aspect, an embodiment of the present application further provides a computer program product, which includes instructions stored on a computer-readable storage medium, and when the instructions are executed on a computer device, the computer device executes a method according to any one of the implementation methods of any of the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 A flowchart of a method for virtual function permission management provided in an embodiment of the present application;

[0022] Figure 2 A method based on the embodiment of the present application is provided Figure 1 A schematic diagram of a virtual machine network and a container network for a method for virtual function permission management is shown;

[0023] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The embodiments of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0025] It should be understood that, in the description of this application, "at least one" means one or more, and "a plurality of" means two or more. In addition, unless otherwise specified, the words "first", "second", etc. are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order.

[0026] Figure 1 A flowchart of a method for virtual function rights management provided in an embodiment of the present application. Figure 1 As shown, the method includes the following steps.

[0027] Step S110: configuring at least one physical function, configuring multiple virtual functions associated with the at least one physical function, and managing the operation permission configuration of each of the multiple virtual functions through a physical function driver in the kernel state of the host machine, wherein the multiple virtual functions include a first virtual function and a second virtual function.

[0028] Step S120: Through the first virtual machine in user mode located in the host machine, at least before the loading of the first virtual function is completed, obtain the first operation permission configuration of the first virtual function from the physical function driver, and then determine whether the first operation associated with the first virtual function is authorized by the first operation permission configuration, and when the first operation is not authorized by the first operation permission configuration, return a loading error of the first virtual function.

[0029] Step S130: obtaining, through the first container of the host machine, the second operation permission configuration of the second virtual function from the physical function driver at least before the loading of the second virtual function is completed, and then determining whether the second operation associated with the second virtual function is authorized by the second operation permission configuration, and returning a loading error of the second virtual function when the second operation is not authorized by the second operation permission configuration.

[0030] See also Figure 1 , Figure 1The method for virtual function rights management shown can be applied to technical fields such as cloud computing and large data centers, such as cloud games, short videos, and network function virtualization (NFV). These technical fields and applications have high requirements for data throughput and network latency. In order to realize user-customized input and output resources and to improve resource utilization, a single root input and output virtualization (SRIOV) is used to virtualize multiple virtual functions from a physical function, and then these virtual functions are directly connected to virtual machines and containers, which can improve the input and output processing performance of virtual functions, thereby reducing latency and improving throughput. Virtual machines and containers load virtual function drivers provided by manufacturers and directly connect input and output to hardware. While improving data transmission performance, it also brings hidden dangers. If users of these virtual machines or containers make operational errors or malicious attacks, it may affect the normal operation of the network. In order to achieve the stability of data services, it is necessary to prevent data services that have operational errors or malicious attacks from affecting the normal operation of other data services. If tunnel technology, such as tunnel message encapsulation and decapsulation, is used to establish isolated network channels, although the network channels of different virtual machines and containers can be isolated, it also occupies additional resources and increases latency, which is too cumbersome for small and medium-sized network vendors. In addition, tunnel technology is difficult to limit user errors or malicious attacks from the root. For example, users of virtual machines or containers may modify machine addresses (MAC addresses) or create a large number of sub-interfaces to seize the table specifications of hardware resources, which are difficult to prevent through tunnel technology. In addition, in order to meet the flexibility requirements of user customized input and output resources, on the basis of avoiding network errors caused by user operation errors or malicious attacks, it is necessary to provide sufficient flexibility in operation, so that each user can perform various customized configurations for the virtual machines or containers they rent. Therefore, it is necessary to provide refined management methods to achieve fine-grained virtual function permission management. In addition, both virtual machines and containers may directly connect to virtual functions and establish direct data plane connections with hardware. Therefore, virtual function permission management needs to consider the differences between virtual machines and containers. Virtual machines generally include virtualized underlying computers, including virtualized hardware and underlying operating systems. Containers generally refer to virtualized operating systems. Containers are located on physical servers and their host operating systems. Therefore, containers share the host operating system kernel. Therefore, there are application scenarios where both virtual machine networks and container networks exist. For example, a host machine has both virtual machines and containers. The virtual machines and containers each support virtual function drivers and directly connect to their own virtual functions. Physical functions and virtual functions cannot see each other's operating systems and file systems.Therefore, for application scenarios where virtual machine networks and container networks exist, virtual function permission management needs to take into account the differences between virtual machines and containers, as well as the fact that physical functions and virtual functions cannot see each other's operating systems and file systems. This is described in detail below in conjunction with the specific embodiments of this application. Figure 1 The method for virtual function permission management shown in the figure provides differentiated permission management and selected message filtering in virtual function permission management, which is beneficial for cloud vendors to allocate virtual function resources to virtual machines and containers. It can flexibly manage tenant resources according to the configuration purchased by the tenant, avoid the negative impact caused by tenant operation errors and malicious attacks, and occupy less resources, which is friendly to vendors of small and medium-sized networks.

[0031] Continue reading Figure 1 , in step S110, at least one physical function is configured through a physical function driver in kernel state of the host machine, multiple virtual functions associated with the at least one physical function are configured, and the operation permission configuration of each of the multiple virtual functions is managed, wherein the multiple virtual functions include a first virtual function and a second virtual function. After step S110 is executed, steps S120 and S130 may be executed simultaneously or at different times, or in any order. In step S120, at least before the loading of the first virtual function is completed, the first operation permission configuration of the first virtual function is obtained from the physical function driver through a first virtual machine in user state of the host machine, and then, it is determined whether the first operation associated with the first virtual function is authorized by the first operation permission configuration, and when the first operation is not authorized by the first operation permission configuration, a loading error of the first virtual function is returned. In step S130, through the first container of the host machine, at least before the loading of the second virtual function is completed, the second operation permission configuration of the second virtual function is obtained from the physical function driver, and then, it is determined whether the second operation associated with the second virtual function is authorized by the second operation permission configuration, and when the second operation is not authorized by the second operation permission configuration, a loading error of the second virtual function is returned.

[0032] Continue reading Figure 1 The demand for virtual function channels can come from virtual machines on the host machine or from various containerized applications. Virtual functions virtualize a physical function into multiple virtual functions through SRIOV technology. By using the direct connection between virtual machines and containers and virtual functions, the virtual machines on the host machine, such as the first virtual machine, correspond to the virtual machine network, and the containerized applications, such as the first container, correspond to the container network. The two are directly connected through their respective virtual function drivers. In order to limit user errors or malicious attacks from the root, Figure 1The method for virtual function permission management shown in the figure optimizes the loading of virtual functions. Wherein, for the first virtual machine to load the first virtual function, at least before the loading of the first virtual function is completed, the first virtual machine obtains the first operation permission configuration of the first virtual function from the physical function driver, and then determines whether the first operation associated with the first virtual function is authorized by the first operation permission configuration, and returns a loading error of the first virtual function when the first operation is not authorized by the first operation permission configuration. In this way, when the loading of the first virtual function is completed, it means that the first virtual machine has obtained the corresponding first operation permission configuration from the physical function driver, and determines whether the first operation associated with the first virtual function is sufficiently authorized, so that the user's customized settings for input and output resources can be responded to later according to the configured operation permissions. Conversely, for the first container to load the second virtual function, at least before the loading of the second virtual function is completed, the first container obtains the second operation permission configuration of the second virtual function from the physical function driver, and then determines whether the second operation associated with the second virtual function is authorized by the second operation permission configuration, and returns a loading error of the second virtual function when the second operation is not authorized by the second operation permission configuration. Thus, when the second virtual function is loaded, it means that the first container has obtained the corresponding second operation permission configuration from the physical function driver, and determines whether the second operation associated with the second virtual function has been sufficiently authorized, so that the user's customized settings for input and output resources can be responded to later according to the configured operation permissions. It can be seen that the interface for virtual function permission management is provided by the physical function driver, and then the virtual machine and container are allowed to obtain the corresponding operation permission configuration from the interface provided by the physical function driver when loading the virtual function respectively, and then the corresponding virtual function driver decides whether to support the user operation in the virtual machine or container according to the permission, so that the user's erroneous operation or malicious attack can be restricted from the root. For example, the user operation in the virtual machine or container may attempt to modify the machine address (MAC address) or create a large number of sub-interfaces to seize the table specifications of the hardware resources, such as creating a large number of virtual local area network (VLAN) sub-interfaces to seize the table entry specifications of the hardware's secondary table (L2 table). By setting corresponding operation permission configurations, sufficient operational flexibility can be provided, allowing each user to make various customized configurations for the virtual machines or containers they rent, thereby providing a refined management method and realizing fine-grained virtual function permission management.For example, the first operation permission configuration (corresponding to the first virtual function and the first virtual machine) can be set to allow or prohibit the user from modifying the machine address; for another example, the second operation permission configuration (corresponding to the second virtual function and the first container) can be set to allow the maximum number of VLAN sub-interfaces to be created.

[0033] Continue reading Figure 1 , using the physical function driver to manage the operation permission configuration of each of the multiple virtual functions so as to flexibly set the permissions of the loaded virtual functions, and starting the entire authorization process by the loaded virtual functions, that is, before the loading of the corresponding virtual functions is completed, the corresponding operation permission configuration is obtained from the physical function driver, and then the corresponding virtual function driver decides whether to support the user operation in the virtual machine or container according to the permissions, so that the user's wrong operation or malicious attack can be restricted from the root through the permission management strategy; and only the virtual functions actually loaded can be focused on, so that limited bandwidth resources can be fully utilized to improve resource utilization. Further, because the physical function driver is relied on to manage the operation permission configuration of each of the multiple virtual functions, and the virtual function driver of each virtual machine and container is relied on to determine whether the operation to be performed is supported by the corresponding operation permission configuration, if there is no permission, a loading error can be returned, and if there is permission, the corresponding operation can be executed and returned successfully. In this way, the physical function driver provides an interface based on virtual function permission management, and the cloud vendor uses this interface to configure the permissions of the virtual function, and the virtual function driver responds to the tenant's configuration according to the configured permission management. The hardware supports the message security module, which is driven by physical functions to perform mirrored message filtering to support non-tunnel message filtering. Cloud vendors can flexibly manage tenant resources according to the configuration purchased by tenants, which can avoid tenant misconfiguration and malicious attacks that affect cloud vendor management. Furthermore, for application scenarios with virtual machine networks and container networks, Figure 1 The method for virtual function permission management shown in the figure takes into account the differences between virtual machines and containers, and the fact that in the application scenario where both virtual machine networks and container networks exist, physical functions and virtual functions cannot see each other's operating systems and file systems. The physical function driver is used to manage the operation permission configurations of the multiple virtual functions, so that messages can be transmitted through the hardware bus channel to implement the communication mechanism between the physical function and the virtual function. Further, it can be seen that Figure 1 The method of virtual function permission management shown does not rely on tunnel technology and tunnel messages, and thus achieves the goal of limiting user erroneous operations or malicious attacks from the root. Therefore, it supports application scenarios of non-tunnel technology and non-tunnel message filtering, and can deal with erroneous operations and malicious attacks that are difficult to deal with by tunnel technology, such as modifying machine addresses or creating a large number of sub-interfaces to seize table specifications of hardware resources.

[0034] In conclusion, Figure 1 The method for virtual function permission management shown provides differentiated permission management and selected message filtering in virtual function permission management, which is beneficial for cloud vendors to allocate virtual function resources to virtual machines and containers. It can flexibly manage tenant resources according to the configuration purchased by the tenant, avoid the negative impact caused by tenant operation errors and malicious attacks, and occupy less resources, which is friendly to vendors of small and medium-sized networks; it limits user's erroneous operation or malicious attacks from the root, so it supports application scenarios of non-tunnel technology and non-tunnel message filtering; it takes into account the differences between virtual machines and containers, and takes into account the fact that in the application scenario where virtual machine networks and container networks exist at the same time, physical functions and virtual functions cannot see each other's operating systems and file systems, and manages the operation permission configurations of the multiple virtual functions through physical function drivers, so that messages can be transmitted through hardware bus channels to realize the communication mechanism between physical functions and virtual functions.

[0035] In a possible implementation, the operation permission configuration of each of the multiple virtual functions includes one or more of the following: whether the operation permission to modify the machine address is possessed, whether the operation permission to modify the maximum transmission unit (MTU) is possessed, whether the operation permission to modify the number of virtual LAN sub-interfaces is possessed, whether the operation permission to turn on and off the source machine address anti-fraud check is possessed, whether the operation permission to configure the downstream bandwidth is possessed, and whether the operation permission to configure the upstream bandwidth is possessed. Here, the maximum transmission unit refers to the maximum data packet size that the network can transmit, in bytes, such as the maximum number of bytes that the sender can send a message at one time. In this way, sufficient operational flexibility is provided, allowing each user to perform various customized configurations for the virtual machine or container they rent, providing a refined management method, and realizing fine-grained virtual function permission management. In addition, the user's erroneous operation or malicious attack is restricted from the root, and the application scenarios of non-tunnel technology and non-tunnel message filtering are supported.

[0036] In a possible implementation, the operation permission configuration of each of the multiple virtual functions includes a virtual file system configuration, such as a sysfs virtual file system, and the virtual file system configuration includes a machine address modification permission file, a maximum transmission unit modification permission file, and a virtual LAN sub-interface number configuration permission file. In this way, sufficient operational flexibility is provided, allowing each user to perform various customized configurations for the virtual machine or container rented by the user, providing a refined management method, and realizing fine-grained virtual function permission management.

[0037] In a possible implementation, the first virtual machine includes a first virtual function driver, which is located in the user state and is used to load the first virtual function and perform the first operation, and the first container includes a second virtual function driver, which is located in the kernel state and is used to load the second virtual function and perform the second operation. In this way, the interface for virtual function permission management is provided by the physical function driver, and then the virtual machine and the container obtain the corresponding operation permission configuration from the interface provided by the physical function driver when loading the virtual function respectively, and then the corresponding virtual function driver determines whether to support the user operation in the virtual machine or container according to the permission, so that the user's erroneous operation or malicious attack can be limited from the root. In addition, the differences between virtual machines and containers can be flexibly dealt with. The virtual function driver of the virtual machine, such as the first virtual function driver, is generally located in the user state, and the virtual function driver of the container, such as the second virtual function driver, is generally located in the kernel state. By setting the corresponding operation permission configuration, sufficient flexibility in operation is provided, and each user can perform various customized configurations for the virtual machine or container rented by himself, thereby providing a refined management method and realizing fine-grained virtual function permission management.

[0038] In some embodiments, when the first operation is authorized by the first operation permission configuration, the first virtual function driver executes the first operation, and when the second operation is authorized by the second operation permission configuration, the second virtual function driver executes the second operation. In this way, differentiated permission management and selected message filtering in virtual function permission management are provided, which is beneficial for cloud vendors to allocate virtual function resources to virtual machines and containers, and can flexibly manage tenant resources according to the configuration purchased by the tenant, which can avoid the negative impact caused by tenant operation errors and malicious attacks, and occupy less resources, which is friendly to vendors of small and medium-sized networks.

[0039] In some embodiments, the first virtual function driver includes a first sending mailbox and a first receiving mailbox, the second virtual function driver includes a second sending mailbox and a second receiving mailbox, the physical function driver includes a third sending mailbox and a third receiving mailbox, the hardware side of the host machine includes a public mailbox, the interaction between the first virtual function driver and the physical function driver is realized through the first sending mailbox, the first receiving mailbox, the third sending mailbox, the third receiving mailbox and the public mailbox, and the interaction between the second virtual function driver and the physical function driver is realized through the second sending mailbox, the second receiving mailbox, the third sending mailbox, the third receiving mailbox and the public mailbox. In the application scenario where both the virtual machine network and the container network exist, the physical function and the virtual function cannot see each other's operating system and file system factors, and the physical function driver is used to manage the operation permission configuration of each of the multiple virtual functions, so that the hardware bus channel can be relied on to transmit messages, so as to realize the communication mechanism between the physical function and the virtual function. In this way, the interaction between the first virtual function driver and the physical function driver is realized through the mailbox mechanism, and the interaction between the second virtual function driver and the physical function driver is realized.

[0040] In some embodiments, the interaction between the first virtual function driver and the physical function driver is isolated from the interaction between the second virtual function driver and the physical function driver based on non-tunnel messages. In this way, application scenarios of non-tunnel technology and non-tunnel message filtering are supported, and erroneous operations and malicious attacks that are difficult to deal with by tunnel technology can be dealt with, such as modifying machine addresses or creating a large number of sub-interfaces to seize table specifications of hardware resources.

[0041] In some embodiments, the hardware side includes a message security module, and the message security module is used to support the physical function driver so as to provide a mirror message filtering function for the interaction between the first virtual function driver and the physical function driver and the interaction between the second virtual function driver and the physical function driver. In this way, differentiated permission management and selected message filtering in virtual function permission management are provided to allow each user to perform various customized configurations for the virtual machine or container rented by the user, provide a refined management method, and realize fine-grained virtual function permission management, which is conducive to meeting the flexibility requirements of user customized input and output resources.

[0042] In some embodiments, the mirrored message filtering function includes a filtering function based on a network protocol address or a machine address. Thus, differentiated rights management and selected message filtering in terms of virtual function rights management are provided.

[0043] In some embodiments, the physical function driver is also used to provide a configuration interface, and the configuration interface is used to set the parameters of the mirror message filtering function, and the parameters include one or more of the following: whether it is a layer 2 message, whether there is an inner layer message of a matching tunnel, the source machine address of the layer 2 message, the destination machine address of the layer 2 message, the Ethernet type of the layer 2 message, whether it is a network protocol layer message, the source network protocol address of the network protocol layer message, the destination network protocol address of the network protocol layer message, the protocol number of the network protocol layer message, the source port of the network protocol layer message, the destination port of the network protocol layer message, whether to perform message discarding, and whether to perform message speed limiting. In this way, it supports filtering various messages and provides security management functions.

[0044] In a possible implementation, the method further includes: uninstalling the first virtual function and notifying the physical function driver through the first virtual machine, and then reclaiming the resources of the first virtual function through the physical function driver; uninstalling the second virtual function and notifying the physical function driver through the first container, and then reclaiming the resources of the second virtual function through the physical function driver. In this way, resource recycling is achieved, which is conducive to improving resource utilization.

[0045] In a possible implementation, the physical function driver manages the operation permission configurations of the multiple virtual functions to prevent operation errors and malicious attacks. In this way, user error operations or malicious attacks are restricted from the root, thus supporting application scenarios of non-tunnel technology and non-tunnel message filtering.

[0046] Figure 2 A method based on the embodiment of the present application is provided Figure 1 A schematic diagram of a virtual machine network and a container network for a method for virtual function permission management is shown. Figure 2 As schematically shown in FIG. Figure 1The method for virtual function permission management shown in the figure, the virtual machine network includes a virtual machine 220, and the container network includes a container 230. The method for virtual function permission management includes: configuring at least one physical function (taking physical function 280 as an example) through a physical function driver 210 located in the kernel state 204 of the host machine, configuring multiple virtual functions (virtual function A282 and virtual function B284) that are associated with the at least one physical function, and managing the operation permission configuration of each of the multiple virtual functions, wherein the multiple virtual functions include a first virtual function (virtual function A282) and a second virtual function (virtual function B284); obtaining a first operation permission configuration of the first virtual function (virtual function A282) from the physical function driver 210 through a first virtual machine (virtual machine 220) located in the user state 202 of the host machine at least before the loading of the first virtual function (virtual function A282) is completed, and then determining the operation permission configuration of the first virtual function (virtual function A282). whether the first operation associated with the first virtual function (virtual function A282) is authorized by the first operation permission configuration, and when the first operation is not authorized by the first operation permission configuration, a loading error of the first virtual function (virtual function A282) is returned; through the first container (container 230) of the host machine, at least before the loading of the second virtual function (virtual function B284) is completed, the second operation permission configuration of the second virtual function (virtual function B284) is obtained from the physical function driver 210, and then, it is determined whether the second operation associated with the second virtual function (virtual function B284) is authorized by the second operation permission configuration, and when the second operation is not authorized by the second operation permission configuration, a loading error of the second virtual function (virtual function B284) is returned.

[0047] See also Figure 2 , Figure 2The virtual machine network and container network shown provide differentiated permission management and selected message filtering in terms of virtual function permission management, which is beneficial for cloud vendors to allocate virtual function resources to virtual machines (such as virtual machine 220) and containers (such as container 230). Tenant resources can be flexibly managed according to the configuration purchased by the tenant, and negative impacts caused by tenant operation errors and malicious attacks can be avoided. In addition, the network occupies less resources and is friendly to vendors of small and medium-sized networks. It limits user erroneous operations or malicious attacks from the root, and therefore supports application scenarios of non-tunnel technology and non-tunnel message filtering. The differences between virtual machines and containers are taken into account, as well as the fact that in application scenarios where virtual machine networks and container networks exist at the same time, physical functions and virtual functions cannot see each other's operating systems and file systems. The operation permission configurations of the multiple virtual functions are managed by physical function drivers, so that messages can be transmitted through hardware bus channels to implement a communication mechanism between physical functions and virtual functions.

[0048] See also Figure 2 In some embodiments, the first virtual machine (virtual machine 220) includes a first virtual function driver (virtual function driver A222), which is located in the user state and is used to load the first virtual function (virtual function A282) and perform the first operation, and the first container (container 230) includes a second virtual function driver (virtual function driver B232), which is located in the kernel state and is used to load the second virtual function (virtual function B284) and perform the second operation. In this way, the physical function driver 210 is used to provide an interface for virtual function permission management, and then the virtual machine 220 and the container 230 obtain the corresponding operation permission configuration from the interface provided by the physical function driver 210 when loading the virtual function respectively, and then the corresponding virtual function driver decides whether to support the user operation in the virtual machine 220 or the container 230 according to the permission, so that the user's erroneous operation or malicious attack can be restricted from the root. In addition, it can flexibly respond to the differences between virtual machines and containers. By setting corresponding operation permission configurations, it provides sufficient operational flexibility and allows each user to make various customized configurations for the virtual machines or containers they rent. Therefore, it provides a refined management method and realizes fine-grained virtual function permission management.

[0049] In some embodiments, the first virtual function driver (virtual function driver A222) includes a first sending mailbox (sending mailbox A224) and a first receiving mailbox (receiving mailbox A226), the second virtual function driver (virtual function driver B232) includes a second sending mailbox (sending mailbox B234) and a second receiving mailbox (receiving mailbox B236), and the physical function driver 210 includes a third sending mailbox (sending mailbox C214) and a third receiving mailbox (receiving mailbox C216). The hardware side 206 of the host machine includes a public mailbox 250, and the interaction between the first virtual function driver (virtual function driver A222) and the physical function driver 210 is realized through the first sending mailbox (sending mailbox A224), the first receiving mailbox (receiving mailbox A226), the third sending mailbox (sending mailbox C214), the third receiving mailbox (receiving mailbox C216) and the public mailbox 250. The interaction between the second virtual function driver (virtual function driver B232) and the physical function driver 210 is realized through the second sending mailbox (sending mailbox B234), the second receiving mailbox (receiving mailbox B236), the third sending mailbox (sending mailbox C214), the third receiving mailbox (receiving mailbox C216) and the public mailbox 250. In the application scenario where both the virtual machine network and the container network exist, the physical function and the virtual function cannot see each other's operating system and file system. The physical function driver is used to manage the operation permission configuration of each of the multiple virtual functions, so that the hardware bus channel can be relied on to transmit messages to realize the communication mechanism between the physical function and the virtual function. In this way, the interaction between the first virtual function driver and the physical function driver is realized through the mailbox mechanism, and the interaction between the second virtual function driver and the physical function driver is realized.

[0050] Figure 33 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application, and the computing device 300 includes: one or more processors 310, a communication interface 320 and a memory 330. The processor 310, the communication interface 320 and the memory 330 are interconnected via a bus 340. Optionally, the computing device 300 may also include an input / output interface 350, and the input / output interface 350 is connected to an input / output device for receiving parameters set by a user, etc. The computing device 300 can be used to implement some or all of the functions of the device embodiment or system embodiment in the above-mentioned embodiment of the present application; the processor 310 can also be used to implement some or all of the operating steps of the method embodiment in the above-mentioned embodiment of the present application. For example, the specific implementation of the various operations performed by the computing device 300 can refer to the specific details in the above-mentioned embodiments, such as the processor 310 is used to perform some or all of the steps in the above-mentioned method embodiment or some or all of the operations in the above-mentioned method embodiment. For another example, in an embodiment of the present application, the computing device 300 may be used to implement part or all of the functions of one or more components in the above-mentioned apparatus embodiment. In addition, the communication interface 320 may be specifically used to perform the communication functions necessary to implement the functions of these apparatuses and components, and the processor 310 may be specifically used to perform the processing functions necessary to implement the functions of these apparatuses and components.

[0051] It should be understood that Figure 3 The computing device 300 may include one or more processors 310, and the multiple processors 310 may provide processing capabilities in a parallel connection mode, a serial connection mode, a serial-parallel connection mode, or any connection mode, or the multiple processors 310 may form a processor sequence or a processor array, or the multiple processors 310 may be divided into a main processor and an auxiliary processor, or the multiple processors 310 may have different architectures such as a heterogeneous computing architecture. In addition, Figure 3 The computing device 300 shown in the figure, and the related structural description and functional description are exemplary and non-limiting. In some exemplary embodiments, the computing device 300 may include Figure 3 More or fewer components may be shown, or some components may be combined or separated, or may have a different arrangement of components.

[0052] The processor 310 may have a variety of specific implementation forms. For example, the processor 310 may include a central processing unit (CPU), a graphic processing unit (GPU), a neural-network processing unit (NPU), a tensor processing unit (TPU) or a data processing unit (DPU), etc., and the embodiment of the present application does not specifically limit it. The processor 310 may also be a single-core processor or a multi-core processor. The processor 310 may be a combination of a CPU and a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The processor 310 may also be implemented using a logic device with built-in processing logic alone, such as an FPGA or a digital signal processor (DSP). The communication interface 320 may be a wired interface or a wireless interface for communicating with other modules or devices. The wired interface may be an Ethernet interface, a local interconnect network (LIN), etc., and the wireless interface may be a cellular network interface or a wireless local area network interface, etc.

[0053] The memory 330 may be a non-volatile memory, such as a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The memory 330 may also be a volatile memory, which may be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM). The memory 330 may also be used to store program codes and data, so that the processor 310 calls the program codes stored in the memory 330 to execute some or all of the operation steps in the above method embodiment, or to execute the corresponding functions in the above device embodiment. Figure 3 Show more or fewer components, or have different component configurations.

[0054] The bus 340 may be a peripheral component interconnect express (PCIe) bus, an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus 340 may be divided into an address bus, a data bus, a control bus, etc. In addition to the data bus, the bus 340 may also include a power bus, a control bus, and a status signal bus, etc. However, for the sake of clarity, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0055] The method and device provided in the embodiments of the present application are based on the same inventive concept. Since the principles of solving the problems in the methods and devices are similar, the embodiments, implementation methods, examples or implementation methods of the methods and devices can refer to each other, and the repeated parts will not be repeated. The embodiments of the present application also provide a system, which includes multiple computing devices, and the structure of each computing device can refer to the structure of the computing device described above. The functions or operations that can be implemented by the system can refer to the specific implementation steps in the above method embodiments and / or the specific functions described in the above device embodiments, which will not be repeated here.

[0056] The present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer device (such as one or more processors), the method steps in the above method embodiment can be implemented. The specific implementation of the processor of the computer-readable storage medium in executing the above method steps can refer to the specific operations described in the above method embodiment and / or the specific functions described in the above device embodiment, which will not be repeated here.

[0057] It should be understood by those skilled in the art that the embodiments of the present application may be provided as methods, systems, or computer program products. The present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. The embodiments of the present application may be implemented in whole or in part by software, hardware, firmware, or any other combination. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The present application may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiments of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. Computer-readable storage media can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media. Available media can be magnetic media (such as floppy disks, hard disks, tapes), optical media, or semiconductor media. Semiconductor media can be solid-state hard disks, random access memory, flash memory, read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, or any other form of suitable storage media.

[0058] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. Each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0059] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. The steps in the method of the embodiment of the present application can be adjusted in order, merged or deleted according to actual needs; the modules in the system of the embodiment of the present application can be divided, merged or deleted according to actual needs. If these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

1. A method for virtual function rights management, characterized in that: The method comprises: By means of a physical function driver in a kernel state of a host machine, at least one physical function is configured, a plurality of virtual functions associated with the at least one physical function are configured, and operation permission configurations of the plurality of virtual functions are managed, wherein the plurality of virtual functions include a first virtual function and a second virtual function; obtaining, through a first virtual machine in user mode located in the host machine, a first operation permission configuration of the first virtual function from the physical function driver at least before the first virtual function is loaded, and then determining whether a first operation associated with the first virtual function is authorized by the first operation permission configuration, and returning a loading error of the first virtual function when the first operation is not authorized by the first operation permission configuration; obtaining, through the first container of the host machine, from the physical function driver, a second operation permission configuration of the second virtual function at least before the loading of the second virtual function is completed, and then determining whether a second operation associated with the second virtual function is authorized by the second operation permission configuration, and returning a loading error of the second virtual function when the second operation is not authorized by the second operation permission configuration, The first virtual machine includes a first virtual function driver, the first virtual function driver is located in the user state and is used to load the first virtual function and perform the first operation, the first container includes a second virtual function driver, the second virtual function driver is located in the kernel state and is used to load the second virtual function and perform the second operation, The first virtual function driver includes a first sending mailbox and a first receiving mailbox, the second virtual function driver includes a second sending mailbox and a second receiving mailbox, the physical function driver includes a third sending mailbox and a third receiving mailbox, the hardware side of the host machine includes a public mailbox, the interaction between the first virtual function driver and the physical function driver is realized through the first sending mailbox, the first receiving mailbox, the third sending mailbox, the third receiving mailbox and the public mailbox, and the interaction between the second virtual function driver and the physical function driver is realized through the second sending mailbox, the second receiving mailbox, the third sending mailbox, the third receiving mailbox and the public mailbox, The hardware side includes a message security module, the message security module is used to support the physical function driver so as to provide a mirror message filtering function for the interaction between the first virtual function driver and the physical function driver and the interaction between the second virtual function driver and the physical function driver, The physical function driver is also used to provide a configuration interface, which is used to set the parameters of the mirror message filtering function, and the parameters include one or more of the following: whether it is a layer 2 message, whether there is an inner layer message of a matching tunnel, the source machine address of the layer 2 message, the destination machine address of the layer 2 message, the Ethernet type of the layer 2 message, whether it is a network protocol layer message, the source network protocol address of the network protocol layer message, the destination network protocol address of the network protocol layer message, the protocol number of the network protocol layer message, the source port of the network protocol layer message, the destination port of the network protocol layer message, whether to perform message discarding, and whether to perform message speed limiting.

2. The method according to claim 1, characterized in that: The operation permission configuration of each of the multiple virtual functions includes one or more of the following: whether the operation permission to modify the machine address is possessed, whether the operation permission to modify the maximum transmission unit is possessed, whether the operation permission to modify the number of virtual LAN sub-interfaces is possessed, whether the operation permission to turn on and off the source machine address anti-fraud check is possessed, whether the operation permission to configure the downstream bandwidth is possessed, and whether the operation permission to configure the upstream bandwidth is possessed.

3. The method according to claim 1, characterized in that The operation permission configurations of the respective virtual functions include a virtual file system configuration, and the virtual file system configuration includes a machine address modification permission file, a maximum transmission unit modification permission file, and a virtual local area network sub-interface quantity configuration permission file.

4. The method according to claim 1, characterized in that: When the first operation is authorized by the first operation permission configuration, the first virtual function driver executes the first operation, and when the second operation is authorized by the second operation permission configuration, the second virtual function driver executes the second operation.

5. The method according to claim 1, characterized in that The interaction between the first virtual function driver and the physical function driver is isolated from the interaction between the second virtual function driver and the physical function driver based on non-tunnel messages.

6. The method according to claim 1, characterized in that The mirrored message filtering function includes a filtering function based on a network protocol address or a machine address.

7. The method according to claim 1, characterized in that The method further comprises: Uninstalling the first virtual function through the first virtual machine and notifying the physical function driver, and then reclaiming resources of the first virtual function through the physical function driver; The second virtual function is uninstalled through the first container and the physical function driver is notified. Then, the resources of the second virtual function are reclaimed through the physical function driver.

8. The method according to claim 1, characterized in that The physical function driver prevents operation errors and malicious attacks by managing the operation permission configurations of the multiple virtual functions.

9. A computer device, characterized in that: The computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, which, when executed on a computer device, cause the computer device to perform the method according to any one of claims 1 to 8.

Images