Flow table unloading system, equipment and cluster

Abstract

The invention provides a flow table unloading system, equipment and a cluster. The system comprises a host used for unloading a first flow table item to a flow table space of unloading hardware and unloading first press-in information to a tunnel mirror image space of the unloading hardware, the first flow table item comprises a first matching item and a first action item, the first action item comprises a first index, the first index is associated with the first press-in information, and the first matching item is matched with the first press-in information; the first press-in information comprises public information of a first tunnel message header and a first mirror image message header; the hardware unloading module is also used for receiving a first original message, acquiring first press-in information from a tunnel mirror image space according to a first index of a first action item under the condition that message header information of the first original message is matched with a first matching item in a flow table space, and sending the first press-in information to the flow table space; and adding a first tunnel message header and a first mirror image message header to the first original message based on the first press-in information to obtain a first tunnel mirror image message.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a flow table unloading system, device, and cluster. Background Art

[0002] With the development of cloud computing networks, its extensive business needs have led to the rapid growth of data centers and a sharp increase in data traffic. The limitations of data forwarding through the host's virtual switch have become increasingly prominent, and it is increasingly unable to meet the growing business needs. In order to meet the needs of high-performance business forwarding, special offload hardware is required to carry data forwarding services. There are many tunnel messages in cloud computing networks, so the amount of tunnel mirror message push information for troubleshooting network failures is also increasing. However, the storage specifications of the tunnel mirror message push information are limited. Once the 64 specifications of the tunnel mirror message header push information are exceeded, the original tunnel mirror message header push information can only be released after the mirror message header push information can continue to be stored, which greatly wastes time. Summary of the invention

[0003] The present application provides a flow table unloading system, device and cluster, which can effectively improve the specifications of the tunnel mirror space.

[0004] In a first aspect, a flow table unloading system is provided, comprising: A host, configured to unload a first flow table entry to a flow table space of unloading hardware, and unload first push information to a tunnel mirror space of the unloading hardware, wherein the first flow table entry includes a first matching item and a first action item, the first action item includes a first index, the first index is associated with the first push information, and the first push information includes common information of a first tunnel message header and a first mirror message header; The unloading hardware is also used to receive a first original message. When the message header information of the first original message matches the first matching item in the flow table space, the first push information is obtained from the tunnel mirror space according to the first index of the first action item, and the first tunnel message header and the first mirror message header are added to the first original message based on the first push information to obtain a first tunnel mirror message.

[0005] In the above scheme, since the tunnel header and the mirror header are basically the same, common information can be extracted from the first tunnel header and the first mirror header as push information, so that the unloading hardware only needs to fill in one push information in the tunnel mirror space, and the tunnel header and the mirror header can be restored according to this push information, thereby reducing the amount of push information that needs to be stored in the tunnel mirror space. For example, the specification of the compressed information of the tunnel header can be 8,000, and the specification of the compressed information of the mirror header can be 64. If the push information of the tunnel header and the push information of the mirror header are managed separately, once the 64 specifications of the push information of the mirror header are used up, the push information of the mirror header can only be stored after the push information of the mirror header is released, which greatly wastes time. In addition, if the push information of the tunnel message header and the push information of the mirror message header are stored separately, when the tunnel message header and the mirror message header are the same, the host needs to push the information twice to the offloading hardware, which greatly increases the power consumption when there are many flow tables and the traffic is large.

[0006] In some possible designs, the host is further used to unload a second flow table entry to the flow table space, wherein the second flow table entry includes a second matching item and a second action item, and the second action item includes the first index; The offloading hardware is also used to receive a second original message. When the message header information of the second original message matches the second matching item in the flow table space, the first push information is obtained from the tunnel mirror space according to the first index of the second action item, and the first tunnel message header is added to the second original message based on the first push information to obtain a first tunnel message.

[0007] In the above scheme, the tunnel mirror space push information can be used for tunnel mirror messages as well as tunnel messages, which can further improve the reuse rate of the push information and further reduce the amount of push information that needs to be stored in the tunnel mirror space.

[0008] In some possible designs, the host is further used to unload a third flow table entry to the flow table space, and unload the second push information to the tunnel mirror space, wherein the third flow table entry includes a third matching item and a third action item, the third action item includes a second index, the second index is associated with the second push information, the second push information includes information of a second tunnel message header, and the first push information and the second push information share specifications of the tunnel mirror space; The offloading hardware is also used to receive a third original message. When the message header information of the third original message matches the third matching item in the flow table space, the second push information is obtained from the tunnel mirror space according to the second index of the third action item, and the second tunnel message header is added to the third original message based on the second push information to obtain a second tunnel message.

[0009] In some possible designs, the host is further used to unload a fourth flow table entry to the flow table space, wherein the fourth flow table entry includes a fourth matching item and a fourth action item, and the fourth action item includes the first index; The offloading hardware is also used to receive a fourth original message, and when the message header information of the fourth original message matches the fourth matching item in the flow table space, the first push information is obtained from the tunnel mirror space according to the first index of the fourth action item, and the first mirror message header is added to the fourth original message based on the first push information to obtain a first mirror message.

[0010] In the above scheme, the tunnel mirror space push information can be used for the tunnel mirror message as well as the mirror message, which can further improve the reuse rate of the push information and further reduce the amount of push information that needs to be stored in the tunnel mirror space.

[0011] In some possible designs, the host is further used to unload a fifth flow table entry to the flow table space, and unload the third push information to the tunnel mirror space, wherein the fifth flow table entry includes a fifth matching item and a fifth action item, the fifth action item includes a third index, the third index is associated with the third push information, the third push information includes information of the second mirror message header, and the first push information and the third push information share the specification of the tunnel mirror space; The offloading hardware is also used to receive a fifth original message, and when the message header information of the fifth original message matches the fifth matching item in the flow table space, the third push information is obtained from the tunnel mirror space according to the third index of the fifth action item, and the second mirror message header is added to the fifth original message based on the third push information to obtain a second mirror message.

[0012] In some possible designs, the first action item also includes one or more modification actions; The offloading hardware is also used to add the first tunnel message header to the first original message when the port identifier is an egress port identifier, perform the modification action on the first tunnel message header to obtain a third tunnel message header, copy the third tunnel message header to obtain a third mirror message header, and add the third mirror message header to obtain an egress port mirror message.

[0013] In the above scheme, it is necessary to edit the tunnel message and the mirror message separately when mirroring the egress port. Therefore, when there are multiple modification actions for the action items of the flow table items for generating the tunnel message and the mirror message according to the original message, the check value needs to be recalculated after each modification. Especially when there are many actions (up to 16), it is quite time-consuming and inefficient.

[0014] In some possible designs, the offload hardware is also used to add the first tunnel message header to the first original message when the port identifier is an egress port identifier, copy the first tunnel message header to obtain the first mirror message header, and add the first mirror message header to obtain an ingress port mirror message.

[0015] In some possible designs, the first tunnel message header and the first mirror message header are identical except for the virtual network interface identifier.

[0016] In a second aspect, a computing device is provided, including a flow table unloading system and a storage unit, wherein the flow table unloading system and the storage unit can communicate with each other, and the flow table unloading system is a system as described in any one of the first aspects.

[0017] In a third aspect, a computing device cluster is provided, comprising a plurality of computing devices, at least one computing device comprising a flow table unloading system and a storage unit, the flow table unloading system and the storage unit being capable of communicating with each other, and the flow table unloading system being a system as described in any one of the first aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the background technology, the drawings required for use in the embodiments of the present invention or the background technology will be described below.

[0019] Figure 1 It is a structural diagram of a software defined network (SDN) provided by this application; Figure 2 It is a structural schematic diagram of a flow table unloading system provided by this application; Figure 3 It is a structural diagram of another flow table unloading system provided by the present application; Figure 4 This is a schematic diagram of the structure of a tunnel mirror provided by this application; Figure 5 It is a structural schematic diagram of a computing device provided by this application. DETAILED DESCRIPTION

[0020] The embodiments of the present invention are described below in conjunction with the accompanying drawings in the embodiments of the present invention. The terms used in the implementation mode of the present invention are only used to explain the specific embodiments of the present invention, and are not intended to limit the present invention.

[0021] See also Figure 1 , Figure 1 This is a schematic diagram of the structure of an SDN provided by this application. Figure 1 As shown, the software defined network of the present application includes: an SDN controller 110 and an open virtual switch (open vSwitch, OVS) 120.

[0022] The SDN controller 110 is a core component in the SDN architecture, which is responsible for the centralized management and control of the entire network. The SDN controller separates the control plane of the network from the data plane, thereby providing a more flexible, programmable and scalable network management method. The main functions of the SDN controller include: managing the control plane of the entire network, including topology discovery, route calculation, flow table delivery, etc. Specifically, the SDN controller 110 collects the topology information of the network by communicating with OVS120, calculates the route according to the application requirements, and then delivers the flow table to OVS120. Secondly, the SDN controller 110 can dynamically adjust the network routing and traffic distribution according to the characteristics and requirements of the traffic, thereby achieving load balancing, congestion control and service quality assurance of the traffic; it can implement security measures such as access control, traffic filtering and intrusion detection, and respond to network security events in a timely manner to protect the network from malicious attacks and data leakage threats, etc. The SDN controller 110 can be a physical device or a virtual device. When the number of SDN controllers 110 is multiple, physical devices and virtual devices can also be used in combination. The SDN controller 110 can run in physical servers, virtual machines, containers, cloud platforms, and bare metal servers.

[0023] OVS120 is an open source virtual switch software that implements a flexible, programmable and scalable switch platform for communicating with the SDN controller through the OpenFlow protocol, receiving the flow table issued by the SDN controller 110, and implementing traffic forwarding and routing according to the flow table. OVS120 supports packet switching and routing in Layer 2 and Layer 3 networks, so OVS120 supports the processing of Ethernet data frames and data packets, etc. OVS120 can run on physical servers, virtual machines, containers, cloud platforms, and bare metal servers. OVS120 can also be used in combination with physical switches, etc.

[0024] The SDN controller 110 and OVS120 can both be set in a container. In this case, the SDN controller 110 and OVS120 can be concentrated in the same container or distributed in different containers. The SDN controller 110 and OVS120 can both be set in a virtual machine. In this case, the SDN controller 110 and OVS120 can be concentrated in the same virtual machine or distributed in different virtual machines. The SDN controller 110 and OVS120 can both be set in a server. In this case, the SDN controller 110 and OVS120 can be concentrated in the same server or distributed in different servers. The SDN controller 110 and OVS120 can both be set in a bare metal server. In this case, the SDN controller 110 and OVS120 can be concentrated in the same bare metal server or distributed in different bare metal servers. Alternatively, the SDN controller 110 is set in a container, and OVS120 is set in any one of a virtual machine, a server, and a bare metal server. The SDN controller 110 is set in the virtual machine, and the OVS 120 is set in any one of the container, the server, and the bare metal server. The SDN controller 110 is set in the server, and the OVS 120 is set in any one of the container, the virtual machine, and the bare metal server. The SDN controller 110 is set in the bare metal server, and the OVS 120 is set in any one of the container, the virtual machine, and the server.

[0025] The following will describe the process of transmitting a data packet from a source IP address to a destination IP address in conjunction with a specific embodiment. First, the user can perform routing calculations on the SDN controller 110 based on the source IP address, the destination IP address, and the network topology of the SDN to obtain a suitable forwarding path, and generate a flow table entry based on the forwarding path. Then, the SDN controller sends the flow table entry to the relevant OVS120. When a data packet arrives at OVS120, OVS120 checks its header information and matches it with the matching items in the flow table entry. If the header information of the data packet can match the matching items, OVS120 will forward the data packet according to the forwarding items of the flow table entry.

[0026] The above OVS120 is usually virtualized using computing resources (e.g., processor), storage resources, and network resources (e.g., network card) of computing devices. In addition, in order to improve the forwarding performance of OVS120, it is often necessary to set up offload hardware for acceleration. Therefore, the processor, offload hardware, and network card can form a flow table offload system. Figure 2 , Figure 2 Schematic diagram of a flow table unloading system provided by this application. Figure 2 As shown, the flow table offloading system application of the present application includes a processor 230 , offloading hardware 220 , and a network card 240 .

[0027] Processor 230 is a computing core and a control core that can handle complex situations. Processor 230 can be a very large-scale integrated circuit. An operating system and other software programs are installed in the processor, so that processor 230 can access memory and various PCIE devices. Processor 230 can quickly access memory through an on-chip bus. The processor may include one or more processor cores. In one implementation, processor 230 may be a multi-core chip, that is, a chip containing multiple processing cores. In another implementation, the processor may include one or more processor cores. It may be a chip with one processing core. OVS and Data Plane Development Kit (DPDK) can be run in processor 230. For an introduction to OVS, see Figure 1 The relevant description in . OVS is not efficient in reading memory. The lightweight library function of DPDK adopts a very effective memory processing mechanism, that is, it uses a ring buffer to transmit data packets back and forth between the physical network card and the virtual switch using DPDK, thereby improving the overall performance of the system. OVS lacks optimization in the processing of high-speed data packets. As a result, many steps in the process of data packet processing require the use of processor 230. Since the processor needs to handle multiple tasks, its availability (especially when overloaded) will have performance bottleneck problems. In order to reduce the number of processor interrupts required for data packet reading, DPDK adopts a periodic polling mechanism to regularly poll new data packets. If the data packet rate drops to a very low value, it can be switched to interrupt mode instead of regular polling mode. Through effective cache management, optimized minimum number of CPU interrupts and other enhanced functions, DPDK can enable virtual switches to achieve near-native performance.

[0028] The offloading hardware 220 is usually used to store flow tables, etc. The offloading hardware 220 can use ternary content addressable memory (TCAM), dynamic random access memory (DRAM), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), data processing unit (DPU), etc. The offloading hardware 220 can also be other random access memories, such as static random access memory (SRAM), etc. This embodiment does not limit the number and type of offloading hardware. In addition, the offloading hardware can be configured to have a power preservation function. The power preservation function means that when the system loses power and then powers on again, the data stored in the memory will not be lost.

[0029] The network card 240 is used to receive or send data packets. Since it has a Media Access Control Address (MAC) address, it belongs between Layer 1 and Layer 2 of the Open System Interconnection (OSI) model. It allows users to connect to each other via cables or wirelessly. Each network card has a unique 48-bit serial number called a MAC address, which is written in a ROM on the card. Here, the network card can be a Field Programmable Gate Array (FPGA) network card or an Application Specific Integrated Circuit (ASIC) network card, etc. The network card can interact with the virtual switch, that is, the network card can receive data packets from the virtual switch and can also send data packets to the virtual switch.

[0030] See also Figure 3 , Figure 3 is a structural diagram of another flow table unloading system provided by this application. Figure 3 As shown, the flow table unloading system of the present application includes: The first host 210 is used to unload the first flow table entry to the flow table space of the unloading hardware, and unload the first push information to the tunnel mirror space of the unloading hardware.

[0031] The first flow table entry includes a first matching item and a first action item. The first action item includes a first index. Optionally, the first index also includes one or more modification actions, such as modifying a virtual network identifier (Virtual Network Identifier, VIN), replacing a target port (dport), a network address translation (Network Address Translation, NAT), a virtual local area network (Virtual Local Area Network, VLAN), a destination MAC address, a destination source IP address, etc. The first index is associated with the first push information, and the first push information includes the common information of the first tunnel message header and the first mirror message header. In a specific embodiment, the first push information includes a header length (headsize), layer 2 information, layer 3 information, and port information, etc., wherein the layer 2 information includes a destination (Media Access Control Address, MAC) address, a source MAC address, a network type (dltype), etc. The layer 3 information includes a source Internet Protocol (Internet Protocol, IP) address, a destination IP address, an IP address type (proto), a service type (ToS), a survival time (Time To Live, ttl), etc. The port information includes a source port number (sport), a destination port number (dport), etc. The first push information comes from the common information of the first tunnel message header and the first mirror message header. In a specific embodiment, Figure 4 As shown, after the virtual machine 3.3.3.10 in the first host 210 sends the first tunnel message to the physical function through the open switch, the first tunnel message between the physical function and the second host 3.3.3.16 is forwarded through the tunnel encapsulation with source IP address 7.7.7.7, destination IP address 7.7.7.9, and virtual network identifier 0xc8. When the link between the virtual machine 3.3.3.10 in the first host 210 and the second host 3.3.3.16 fails, it is necessary to copy the first tunnel message between the virtual machine 3.3.3.10 and the second host to obtain a first tunnel mirror message, and forward it to the mirror host 3.3.3.16 through the mirror encapsulation with source IP address 7.7.7.7, destination IP address 7.7.7.9, and virtual network identifier 0x64. Then, The information of the first tunnel message header can be found below: clone(tnl_push(tnl_port(vxlan_sys_4789),header(size=50,type=4,eth(dst=B0:7B:25:18:7f:56,src=5a:2a:b7:8e:32:48,dl_type=0x0800),ipv4(src=7.7. 7.7,dst=7.7.7.9,proto=17,tos=0,ttl=64,frag=0x4000),udp(src=0,dst=4789,csum=0x0),vxlan(flags=0x8000000,vni=0xc8)),out_port(br-ip)),dpdk-pf0).

[0032] The information of the first mirrored message header can be found below: clone(tnl_push(tnl_port(vxlan_sys_4789),header(size=50,type=4,eth(dst=04:3f:72:9b:e3:9f,src=5a:2a:b7:8e:32:48,dl_type=0x0800),ipv4(src=7.7. 7.7,dst=7.7.7.9,proto=17,tos=0,ttl=64,frag=0x4000),udp(src=0,dst=4789,csum=0x0),vxlan(flags=0x8000000,vni=0x64)),out_port(br-ip)),dpdk-pf0).

[0033] It is not difficult to see that the difference between the information in the first tunnel message header and the first mirror message header is that the virtual network identifier (vni) is different.

[0034] In a possible embodiment, the first push information may be represented by a structure: Struct tnl_mir_buf { Char date

[40] ; int count; } The structure includes a character variable (date) of character type (char). Since the length of the character variable is 8 bits, the total length of the 40 character variables is 320. One bit is used to store the port identifier. When the port identifier is the first value, the port identifier is the output port identifier. When the port identifier is the second value, the port identifier is the input port identifier. The remaining 319 bits are used to store the first push information. The structure also includes an integer variable (count) of integer type (int). The integer variable is used to store the number of times the first push information is referenced. The initial value of the integer variable is zero. Whenever the first push information is referenced, the number of the integer variable will increase by 1. Whenever the first push information is dereferenced, the number of the integer variable will decrease by 1.

[0035] If the push information of the tunnel header and the push information of the mirror header are stored in different spaces and use different specifications, for example, the push information of the tunnel header uses a specification of 8,000 push information and the mirror header uses a specification of 64 push information, then once the 64 specifications of the push information of the mirror header are used up, the push information of the mirror header can only be stored after the push information of the mirror header is released, which greatly wastes time. However, in the present application, the push information of the tunnel header and the mirror header share the same specification, wherein sharing the same specification means that the corresponding storage space can be used by both the push information of the tunnel header and the push information of the mirror header. When the push information of the tunnel header is relatively large, the storage space of the push information of the mirror header can be occupied. When the push information of the mirror header is relatively large, the storage space of the push information of the tunnel header can be occupied. In other words, the shared specification is the common space of the push information of the tunnel header and the mirror header. For example, the push information of the tunnel header and the mirror header share 8,000+64 specifications. Therefore, even if the push information of the mirror header exceeds 64, the 8,000 specification can still be used, which will greatly reduce the wasted time. Moreover, there will be no waste of resources due to excessive pre-allocation. If 512 push information of the mirror header is pre-allocated, but the push information of the mirror header is not used so much, only 80 are used, then 432 push information of the mirror header will be wasted.

[0036] When unloading, if the value of the integer variable of the structure is zero, then the tunnel mirror space has not yet stored the first push information, and the first push information can be unloaded into the tunnel mirror space. If the value of the integer variable of the structure is not zero, then the tunnel mirror space has already stored the first push information, and the value of the integer variable of the structure can be increased by 1. When deleting, if the value of the integer variable of the structure is zero, then there is no reference to the first push information of the tunnel mirror space, and the first push information in the tunnel mirror space can be deleted. If the value of the integer variable of the structure is not zero, then there is still a reference to the first push information of the tunnel mirror space, and the value of the integer variable of the structure can be reduced by 1.

[0037] Since the data of the first tunnel message header and the first mirror message header are basically the same, in this solution, only one first push information needs to be downloaded, so the first host only needs to send it once to the uninstall hardware, and the other time only needs to add 1 to the integer variable. If the push information in the first tunnel message header and the push information in the first mirror message header are stored in different spaces, the waste of space can be effectively reduced.

[0038] Since the data of the first tunnel message header and the first mirror message header are basically the same, the first push information only needs to be downloaded once. If the value of the integer variable of the structure is zero, then the tunnel mirror space has not yet stored the first push information, and the first push information can be unloaded to the tunnel mirror space. If the value of the integer variable of the structure is not zero, then the tunnel mirror space has already stored the first push information, and the value of the integer variable of the structure can be increased by 1. If the push information in the first tunnel message header and the push information in the first mirror message header are stored in different spaces respectively, the unloading process needs to be executed twice, which reduces one software and hardware register interaction and reduces power consumption. When the number of flow table items is relatively large, the effect is very significant.

[0039] Since the data of the first tunnel message header and the first mirror message header are basically the same, the first push information only needs to be deleted once. If the value of the integer variable of the structure is zero, then there is no reference to the first push information of the tunnel mirror space, and the first push information in the tunnel mirror space can be deleted. If the value of the integer variable of the structure is not zero, then there is still a reference to the first push information of the tunnel mirror space, and the value of the integer variable of the structure can be reduced by 1. If the push information in the first tunnel message header and the push information in the first mirror message header are stored in different spaces respectively, the deletion process needs to be executed twice, which reduces one software and hardware register interaction and reduces power consumption. When the number of flow table items is relatively large, the effect is very significant.

[0040] The offloading hardware 220 is also used to receive a first original message, and when the message header information of the first original message matches the first matching item in the flow table space, obtain the first push information from the tunnel mirror space according to the first index of the first action item, and add the first tunnel message header and the first mirror message header to the first original message based on the first push information to obtain the first tunnel mirror message.

[0041] Optionally, the first host 210 is also used to unload the second flow table entry to the flow table space. The second flow table entry includes a second matching item and a second action item, and the second action item includes a first index. The unloading hardware 220 is also used to receive a second original message, and when the message header information of the second original message matches the second matching item in the flow table space, obtain the first push information from the tunnel mirror space according to the first index of the second action item, and add the first tunnel message header to the second original message based on the first push information to obtain the first tunnel message. Here, in addition to being provided to the tunnel mirror message, the first push information can also be provided to the tunnel message, thereby further improving the multiplexing rate of the first push information.

[0042] Optionally, the first host 210 is also used to unload the third flow table entry to the flow table space and unload the second push information to the tunnel mirror space. The third flow table entry includes a third matching item and a third action item, the third action item includes a second index, the second index is associated with the second push information, the second push information includes information of the second tunnel message header, and the first push information and the second push information share the specification of the tunnel mirror space. The unloading hardware 220 is also used to receive the third original message, and when the message header information of the third original message matches the third matching item in the flow table space, the second push information is obtained from the tunnel mirror space according to the second index of the third action item, and the second tunnel message header is added to the third original message based on the second push information to obtain the second tunnel message. Here, the tunnel message and the tunnel mirror message also share the tunnel mirror space, which can more effectively improve the utilization rate of the push information in the shared tunnel mirror space.

[0043] Optionally, the first host 210 is also used to unload the fourth flow table entry to the flow table space, wherein the fourth flow table entry includes a fourth matching item and a fourth action item, and the fourth action item includes a first index; the unloading hardware 220 is also used to receive the fourth original message, and when the message header information of the fourth original message matches the fourth matching item in the flow table space, the first push information is obtained from the tunnel mirror space according to the first index of the fourth action item, and the first mirror message header is added to the fourth original message based on the first push information to obtain the first mirror message. Here, in addition to being provided to the tunnel mirror message, the first push information can also be provided to the mirror message, thereby further improving the multiplexing rate of the first push information.

[0044] Optionally, the first host 210 is also used to unload the fifth flow table entry to the flow table space, and unload the third push information to the tunnel mirror space, wherein the fifth flow table entry includes the fifth matching item and the fifth action item, the fifth action item includes the third index, the third index is associated with the third push information, the third push information includes the information of the second mirror message header, and the first push information and the third push information share the specification of the tunnel mirror space; the unloading hardware 220 is also used to receive the fifth original message, and when the message header information of the fifth original message matches the fifth matching item in the flow table space, the third push information is obtained from the tunnel mirror space according to the third index of the fifth action item, and the second mirror message header is added to the fifth original message based on the third push information to obtain the second mirror message. Here, the mirror message and the tunnel mirror message also share the tunnel mirror space, which can more effectively improve the utilization rate of the push information in the shared tunnel mirror space.

[0045] Optionally, the unloading hardware 220 is also used to add a first tunnel message header to the first original message when the port identifier is an egress port identifier, perform a modification action on the first tunnel message header to obtain a third tunnel message header, copy the third tunnel message header to obtain a third mirror message header, and add the third mirror message header to obtain an egress port mirror message, and when the port identifier is an egress port identifier, add a first tunnel message header to the first original message, copy the first tunnel message header to obtain a first mirror message header, and add the first mirror message header to obtain an ingress port mirror message. In the prior art solution, assuming that the modification action includes modifying a virtual network identifier, modifying a destination MAC address, modifying a virtual local area network, and modifying a destination IP address, then, add a first tunnel message header to the first original message, modify the virtual network identifier in the first tunnel message header, recalculate the check value, modify the destination MAC address in the first tunnel message header, recalculate the check value, modify the virtual local area network in the first tunnel message header, recalculate the check value, modify the destination IP address in the first tunnel message header, and recalculate the check value. Add a first mirror message header to the first tunnel message header to obtain a first tunnel mirror message, modify the virtual network identifier in the first mirror message, recalculate the check value, modify the destination MAC address in the first mirror message header, recalculate the check value, modify the virtual LAN in the first mirror message header, recalculate the check value, modify the destination IP address in the first mirror message header, and recalculate the check value. It can be seen that the process of the prior art is very cumbersome, especially if there are many modification actions, the process consumes a lot of performance. In the present application, a first tunnel message header is added to the first original message, the virtual network identifier in the first tunnel message header is modified, the check value is recalculated, the destination MAC address in the first tunnel message header is modified, the check value is recalculated, the virtual LAN in the first tunnel message header is modified, the check value is recalculated, the destination IP address in the first tunnel message header is modified, and the check value is recalculated. Subsequently, it is directly checked whether the egress port identifier on the first pushed information is the egress port identifier. If it is the egress port identifier, it means that it is an egress port mirror. The message header after the first mirror message header is edited should be the same as the message header after the first tunnel message header is edited. Therefore, directly copy the currently edited first tunnel message, add it to the first tunnel message, and recalculate the check value.

[0046] See also Figure 5 , Figure 5 4 is a schematic diagram of a computing device provided by the present application. The computing device 400 includes: one or more processing units 410 , a communication interface 420 and a storage unit 430 .

[0047] The processing unit 410, the communication interface 420 and the storage unit 430 are interconnected via a bus 440. Optionally, the computing device 400 may also include an input / output interface 450, which is connected to an input / output device for receiving parameters set by a user, etc. The computing device 400 can be used to implement some or all of the functions of the device embodiment or system embodiment in the above-mentioned embodiment of the present application; the processing unit 410 can also be used to implement some or all of the operation steps of the method embodiment in the above-mentioned embodiment of the present application. For example, the specific implementation of the various operations performed by the computing device 400 can refer to the specific details in the above-mentioned embodiment, such as the processing unit 410 is used to perform some or all of the steps in the above-mentioned method embodiment or some or all of the operations in the above-mentioned method embodiment. For another example, in the embodiment of the present application, the computing device 400 can be used to implement some or all of the functions of one or more components in the above-mentioned device embodiment, and the communication interface 420 can be specifically used for the communication functions necessary to implement the functions of these devices and components, and the processing unit 410 can be specifically used for the processing functions necessary to implement the functions of these devices and components, etc.

[0048] Figure 5 The computing device 400 may include one or more processing units 410, and the multiple processing units 410 may provide processing capabilities in a coordinated manner in a parallel connection manner, a serial connection manner, a serial-parallel connection manner, or any connection manner, or the multiple processing units 410 may constitute a processor sequence or a processor array, or the multiple processing units 410 may be divided into a main processor and an auxiliary processor, or the multiple processing units 410 may have different architectures such as a heterogeneous computing architecture. In addition, Figure 5 The computing device 400 shown in the figure, and the related structural description and functional description are exemplary and non-limiting. In some exemplary embodiments, the computing device 400 may include Figure 5 More or fewer components may be shown, or some components may be combined or separated, or may have a different arrangement of components.

[0049] The processing unit 410 may have a variety of specific implementation forms. For example, the processing unit 410 may include a processor (central processing unit, CPU), a graphic processing unit (graphic processing unit, GPU), a neural-network processing unit (neural-network processing unit, NPU), a tensor processing unit (tensor processing unit, TPU) or a data processing unit (data processing unit, DPU) and other combinations thereof, which are not specifically limited in the embodiments of the present application. The processing unit 410 may also be a single-core processor or a multi-core processor. The processing unit 410 may be a combination of a CPU and a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (application-specific integrated circuit, ASIC), a programmable logic device (programmable logic device, PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a generic array logic (generic array logic, GAL) or any combination thereof. The processing unit 410 may also be implemented using a logic device with built-in processing logic alone, such as an FPGA or a digital signal processor (digital signal processor, DSP), etc. The communication interface 420 may be a wired interface or a wireless interface for communicating with other modules or devices. The wired interface may be an Ethernet interface, a local interconnect network (LIN), etc., and the wireless interface may be a cellular network interface or a wireless local area network interface, etc.

[0050] The storage unit 430 may be a non-volatile memory, such as a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The storage unit 430 may also be a volatile memory, which may be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous connection dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). The storage unit 430 may also be used to store program codes and data, so that the processing unit 410 can call the program codes stored in the storage unit 430 to execute some or all of the operation steps in the above method embodiment, or to execute the corresponding functions in the above device embodiment. Figure 5 Show more or fewer components, or have different component configurations.

[0051] The bus 440 may be a peripheral component interconnect express (PCIe) bus, an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus 440 may be divided into an address bus, a data bus, a control bus, etc. In addition to the data bus, the bus 440 may also include a power bus, a control bus, and a status signal bus, etc. However, for the sake of clarity, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0052] The present application also provides a system, which includes multiple computing devices, and the structure of each computing device can refer to the structure of the computing device described above. The functions or operations that can be implemented by the system can refer to the specific implementation steps in the above method embodiment and / or the specific functions described in the above device embodiment, which will not be repeated here.

[0053] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one network site, computer, server or data center to another network site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer, or it can be a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape, etc.), an optical medium (e.g., a DVD, etc.), or a semiconductor medium (e.g., a solid-state hard disk), etc. In the above embodiments, the description of each embodiment has different emphases. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

Claims

1. A flow table unloading system, characterized in that: include: A host, configured to unload a first flow table entry to a flow table space of unloading hardware, and unload first push information to a tunnel mirror space of the unloading hardware, wherein the first flow table entry includes a first matching item and a first action item, the first action item includes a first index, the first index is associated with the first push information, and the first push information includes common information of a first tunnel message header and a first mirror message header; The unloading hardware is also used to receive a first original message. When the message header information of the first original message matches the first matching item in the flow table space, the first push information is obtained from the tunnel mirror space according to the first index of the first action item, and the first tunnel message header and the first mirror message header are added to the first original message based on the first push information to obtain a first tunnel mirror message.

2. The system according to claim 1, characterized in that The host is further configured to unload a second flow table entry to the flow table space, wherein the second flow table entry includes a second matching item and a second action item, and the second action item includes the first index; The offloading hardware is also used to receive a second original message. When the message header information of the second original message matches the second matching item in the flow table space, the first push information is obtained from the tunnel mirror space according to the first index of the second action item, and the first tunnel message header is added to the second original message based on the first push information to obtain a first tunnel message.

3. The system according to claim 2, characterized in that The host is further used to unload a third flow table entry to the flow table space, and unload the second push information to the tunnel mirror space, wherein the third flow table entry includes a third matching item and a third action item, the third action item includes a second index, the second index is associated with the second push information, the second push information includes information of a second tunnel message header, and the first push information and the second push information share the specification of the tunnel mirror space; The offloading hardware is also used to receive a third original message. When the message header information of the third original message matches the third matching item in the flow table space, the second push information is obtained from the tunnel mirror space according to the second index of the third action item, and the second tunnel message header is added to the third original message based on the second push information to obtain a second tunnel message.

4. The system according to claim 1, characterized in that The host is further configured to unload a fourth flow table entry to the flow table space, wherein the fourth flow table entry includes a fourth matching item and a fourth action item, and the fourth action item includes the first index; The offloading hardware is also used to receive a fourth original message, and when the message header information of the fourth original message matches the fourth matching item in the flow table space, the first push information is obtained from the tunnel mirror space according to the first index of the fourth action item, and the first mirror message header is added to the fourth original message based on the first push information to obtain a first mirror message.

5. The system according to claim 4, characterized in that The host is further used to unload the fifth flow table entry to the flow table space, and unload the third push information to the tunnel mirror space, wherein the fifth flow table entry includes a fifth matching item and a fifth action item, the fifth action item includes a third index, the third index is associated with the third push information, the third push information includes information of the second mirror message header, and the first push information and the third push information share the specification of the tunnel mirror space; The offloading hardware is also used to receive a fifth original message, and when the message header information of the fifth original message matches the fifth matching item in the flow table space, the third push information is obtained from the tunnel mirror space according to the third index of the fifth action item, and the second mirror message header is added to the fifth original message based on the third push information to obtain a second mirror message.

6. The system according to any one of claims 1 to 5, characterized in that: The first action item also includes one or more modification actions; The offloading hardware is also used to add the first tunnel message header to the first original message when the port identifier is an egress port identifier, perform the modification action on the first tunnel message header to obtain a third tunnel message header, copy the third tunnel message header to obtain a third mirror message header, and add the third mirror message header to obtain an egress port mirror message.

7. The system according to claim 6, characterized in that The offloading hardware is also used to add the first tunnel message header to the first original message when the port identifier is an egress port identifier, copy the first tunnel message header to obtain the first mirror message header, and add the first mirror message header to obtain an ingress port mirror message.

8. The system according to any one of claims 1 to 5, characterized in that: The first tunnel message header and the first mirror message header are identical except for the virtual network interface identifier.

9. A computing device, characterized in that It comprises a flow table unloading system and a storage unit, the flow table unloading system and the storage unit can communicate with each other, and the flow table unloading system is a system as described in any one of claims 1-8.

10. A computing device cluster, characterized in that: It comprises a plurality of computing devices, at least one computing device comprises a flow table unloading system and a storage unit, the flow table unloading system and the storage unit can communicate with each other, and the flow table unloading system is a system as described in any one of claims 1-8.

Images