HK1250189B - Method for message processing in cloud computing system, host and system - Google Patents

Description

Method, host and system for message processing in cloud computing system

Technical Field

The present invention relates to the field of IT technology, and in particular to a method, host, and system for message processing in a cloud computing system.

Background Art

Virtualization technology is one of the key technologies in the field of cloud computing. It can abstract the physical resources of the host into a shared resource pool for use by several virtual machines (VMs) running on the host. Several virtual machines running on the host can share the host's network card and communicate with the host's external network. In the existing technology, the network card can be allocated to the virtual machine through network card virtualization. Network card virtualization can adopt single-root input and output virtualization (SR-IOV) or multi-root input/output virtualization (MR-IOV). The above network card virtualization is also called network card passthrough. Taking SR-IOV passthrough as an example, when the network card supports SR-IOV, SR-IOV technology can be used to share the network card on the host with several virtual machines running on the host.

When using a network card that supports SR-IOV on a host, the network port of the network card will virtualize at least one physical function (PF) and multiple virtual functions (VF), and the virtual machines on the host are connected to at least one VF. The network card contains a switching device with switch functions. This switching device forwards data packets according to the Media Access Control (MAC) table and is responsible for forwarding data packets between PFs, VFs, and physical network ports. However, due to the limited processing and storage capabilities of this switching device, it cannot provide users with rich network functions such as security groups, Quality of Service (QoS), Layer 2 tunnel encapsulation, and distributed routing.

Summary of the Invention

This article describes a method, host, and system for message processing in a cloud computing system to solve the problem of not being able to provide rich network functions in a network card passthrough scenario.

In a first aspect, an embodiment of the present invention provides a host, at least one network card is connected to the host, a virtual machine monitor (VMM) runs on the host, a first virtual machine runs on the VMM, the VMM includes multiple VLAN sub-interfaces and a virtual network function module, the at least one network card includes a switching device and at least three network ports, wherein the first network port and the second network port support network card virtualization capabilities, the first network port corresponds to at least one physical function (PF) and multiple logical functions (VFs), the multiple VFs are configured with VLAN identifiers, and the VLAN identifiers of the VFs are different, the first virtual machine is connected to at least one VF of the first network port, the number of the VLAN sub-interfaces is the same as the number of the VFs of the first network port and corresponds one-to-one, the VLAN sub-interfaces and their corresponding VFs have the same VLAN identifier, and the first network port is connected to the second network port via a network cable.

The first virtual machine sends a data packet to the second virtual machine through the VF connected to itself, and the data packet carries the VLAN ID of the VF that sends the data packet. The switching device of the first network port receives the data packet and forcibly forwards the data packet to the second network port through the network cable. The switching device of the second network port sends the data packet to the VLAN sub-interface with the same VLAN ID as the data packet based on the VLAN ID carried by the data packet. The VLAN sub-interface receives the data packet, removes the VLAN ID of the data packet, and sends the data packet to the virtual network function module. The virtual network function module performs network function processing on the modified data packet and then sends the processed data packet to the second virtual machine. In the scenario of direct network card pass-through, after the virtual machine sends the data packet from the direct-through VF, the data packet can be sent to the virtual network function module in the VMM through the above method. The software module is used to provide users with rich network functions and realize network function processing of data packets.

In one possible design, the first network port and the second network port operate in Virtual Ethernet Port Aggregation (VEPA) mode. The VEPA mode enables mandatory forwarding of data packets between the first network port and the second network port. It should be noted that the VEPA mode is only one method for implementing mandatory forwarding of data packets. Those skilled in the art may employ other software or hardware configurations to implement mandatory forwarding of data packets, and this is not a limitation of the present invention.

In one possible design, the host further includes a device management module, which is used to create a VLAN sub-interface. Specifically:

The device management module is configured to receive a VLAN sub-interface creation request sent by the cloud management platform after the first virtual machine is successfully created, wherein the VLAN sub-interface creation request carries the VLAN identifier of the VF assigned to the first virtual machine;

The device management module is further configured to send a notification message to the VMM, informing the VMM to create a VLAN sub-interface corresponding to the VF of the first virtual machine, wherein the VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN identifier as the VF of the first virtual machine.

The at least one network card includes at least three network ports, and the at least three network ports can be located on the same network card or different network cards. When the first network port and the second network port are located on the same network card, the first network port and the second network port can share a switching device on the network card, or each can have an independent switching device.

In one possible design, the source virtual machine (first virtual machine) and the destination virtual machine (second virtual machine) of the data packet are located on the same host, and the virtual network function module sends the processed data packet to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, wherein the VF connected to the second virtual machine and the VLAN sub-interface receiving the processed data packet have the same VLAN identifier; the VLAN sub-interface corresponding to the VF connected to the second virtual machine adds its own VLAN identifier to the data packet and sends the data packet to the second network port; the switching device of the second network port forcibly forwards the data packet to the first network port through the network cable; the switching device of the first network port sends the data packet to the VF identified by the VLAN identifier in the data packet according to the VLAN identifier carried by the data packet, so that the data packet is transmitted to the second virtual machine.

In one possible design, the source virtual machine (first virtual machine) and the destination virtual machine (second virtual machine) of the data packet are located on different hosts. The virtual network function module is specifically used to establish a tunnel with another virtual network function module on the host where the second virtual machine is located, send the processed data packet to an external physical switch through a third network port, and send the processed data packet to the host where the second virtual machine is located through the external physical switch, so that the other virtual network function module sends the processed data packet to the second virtual machine.

In a second aspect, corresponding to the device of the first aspect, an embodiment of the present invention further provides a method for message processing in a cloud computing system, wherein at least one host in the cloud computing system includes a virtual machine monitor (VMM) and at least one network card, a first virtual machine is running on the host, the VMM includes multiple VLAN sub-interfaces and a virtual network function module, the at least one network card includes a switching device and at least three network ports, wherein the first network port and the second network port support network card virtualization capabilities, the first network port corresponds to at least one PF and multiple VFs, the multiple VFs are configured with VLAN identifiers, and the VLAN identifiers of the VFs are different from each other, the first virtual machine is connected to at least one VF of the first network port, the number of the VLAN sub-interfaces is the same as the number of the VFs of the first network port and corresponds one-to-one, the VLAN sub-interfaces and the corresponding VFs have the same VLAN identifier, and the first network port and the second network port are connected via a network cable, the method comprising:

The first virtual machine sends a data packet to the second virtual machine through the VF connected to itself, where the data packet carries the VLAN identifier of the VF that sends the data packet and the address of the second virtual machine;

The switching device of the first network port receives the data packet and forcibly forwards the data packet to the second network port through the network cable;

The switching device of the second network port receives the data packet from the first network port, and sends the data packet to the VLAN sub-interface identified by the VLAN identifier according to the VLAN identifier carried by the data packet;

The VLAN sub-interface receives the data packet, removes the VLAN identifier of the data packet, and sends the data packet to the virtual network function module;

After performing network function processing on the modified data packet, the virtual network function module sends the processed data packet, and the destination address of the processed data packet is the address of the second virtual machine.

In one possible design, the mode of the first network port and the second network port is VEPA mode.

In one possible design, the method also includes a VLAN sub-interface creation process, which includes: after the first virtual machine is successfully created, the host's device management module receives a VLAN sub-interface creation request sent by the cloud management platform, and the VLAN sub-interface creation request carries the VLAN identifier of the VF assigned to the first virtual machine; the device management module sends a notification message to the VMM, so that the VMM creates a VLAN sub-interface corresponding to the VF of the first virtual machine, and the VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN identifier as the VF of the first virtual machine.

In a third aspect, an embodiment of the present invention provides a cloud computing system, comprising a cloud management platform and the host described in the first aspect, wherein the cloud management platform is used to create the first virtual machine on the host, and after the first virtual machine is successfully created, notify the VMM of the host to create a VLAN sub-interface corresponding to the VF of the first virtual machine, and the VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN identifier as the VF of the first virtual machine.

In a fourth aspect, corresponding to the aforementioned apparatus, method, and system, an embodiment of the present invention provides a host having the function of implementing the host defined in the first aspect. The function can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. Specifically, the host includes a first processor, a first memory, and at least one network card, the network card includes a second processor, a second memory, and at least two network ports, wherein the first network port and the second network port in the at least one network card support network card virtualization capabilities, the first network port corresponds to at least one PF and multiple VFs, the multiple VFs are configured with VLAN identifiers, and the VLAN identifiers of the VFs are different from each other, instructions are stored in the first memory and the second memory, the first processor executes the first instruction in the first memory to implement the function of the first virtual machine, the first virtual machine is connected to at least one VF of the first network port, the first processor executes the second instruction in the first memory to implement the function of the VLAN sub-interface, the first processor executes the third instruction in the first memory to implement the function of the virtual network function module, and the second processor is used to execute the instruction in the second memory to implement the function of the switching device,

The first virtual machine is connected to at least one VF of the first network port, the host includes multiple VLAN sub-interfaces, the number of the multiple VLAN sub-interfaces is the same as the number of VFs of the first network port and corresponds one to one, the VLAN sub-interfaces and their corresponding VFs have the same VLAN identifier, and the first network port is connected to the second network port via a network cable.

The first processor is configured to execute the first instruction in the first memory to perform the steps of: sending a data packet to the second virtual machine through the VF connected to the first processor, the data packet carrying the VLAN identifier of the VF that sends the data packet and the address of the second virtual machine;

The second processor is configured to execute instructions in the second memory to perform the following steps: receiving the data packet, and forcibly forwarding the data packet to the second network port through the network cable;

The second processor is configured to execute instructions in the second memory to perform the steps of: receiving a data packet from the first network port, and sending the data packet to a VLAN sub-interface identified by the VLAN identifier according to a VLAN identifier carried by the data packet;

The first processor is configured to execute the second instruction in the first memory to perform the steps of: receiving the data packet, removing the VLAN identifier of the data packet, and sending the data packet to the virtual network function module;

The first processor is used to execute the third instruction in the first memory to perform the steps: after performing network function processing on the modified data packet, the processed data packet is sent to the second virtual machine according to the address of the second virtual machine.

In one possible design, the host and cloud management platform are implemented by a general-purpose or dedicated server. The server structure includes a processor, memory, a system bus, and input/output interfaces. The processor is configured to support the corresponding functions of the host/cloud management platform in the system. The input/output interfaces are used to communicate with other components in the cloud computing system, and the processor executes instructions stored in the memory.

In a fifth aspect, an embodiment of the present invention provides a computer storage medium for storing computer software instructions for the above-mentioned host, which includes a program designed for executing the above-mentioned aspects.

In a sixth aspect, an embodiment of the present invention provides another computer storage medium for storing computer software instructions used for the switching device in the above-mentioned network card, which includes a program designed for executing the above-mentioned aspect.

In a seventh aspect, an embodiment of the present invention provides a computer program. When a physical server runs the computer program, the physical server executes the functions of the virtual machine, VLAN sub-interface and virtual network function module in the host.

In an eighth aspect, an embodiment of the present invention provides a computer program. When a processor or a programmable logic circuit in a network card runs the computer program, the network card performs the functions of the switching device in the aforementioned aspects.

In summary, a virtual machine sends a data packet from the VF connected to the virtual machine. The switching device on the first network port forcibly forwards the data packet to the second network port. The switching device on the second network port then sends the data packet to the VLAN sub-interface on the VMM based on the VLAN identifier carried in the data packet. The data packet is then passed through the VLAN sub-interface to the virtual network function module, which then provides rich network function processing for the data packet. Based on NIC direct passthrough, after the virtual machine sends a data packet from the direct passthrough VF, the data packet can be sent to the virtual network function module in the VMM through the above method. This software module provides users with rich network functions and implements network function processing for the data packet.

BRIEF DESCRIPTION OF THE DRAWINGS

To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly describes the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings below only depict a portion of the embodiments of the present invention. Those skilled in the art can, without inventive effort, derive other embodiments of the present invention from these drawings. All of these embodiments or implementations fall within the scope of protection of the present invention.

FIG1A is a schematic diagram of a virtualization structure on a host provided by an embodiment of the present invention;

1B is a schematic diagram of a virtualization structure on a host in a network card pass-through scenario provided by an embodiment of the present invention;

FIG2 is a schematic diagram of another virtualization architecture on a host provided by an embodiment of the present invention;

3 is a schematic diagram of a process for creating a virtual machine according to an embodiment of the present invention;

FIG4 is a flow chart of a method for processing messages in a cloud computing system according to an embodiment of the present invention;

FIG5 is a schematic diagram of a hardware structure of a computer device provided by an embodiment of the present invention;

FIG6 is a schematic diagram of the structure of a cloud computing system provided by an embodiment of the present invention.

DETAILED DESCRIPTION

The network architecture and business scenarios described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

As shown in Figure 1A, it is a schematic diagram of the virtualization structure on the host provided by an embodiment of the present invention. The host is a physical server, and the bottom layer of the physical server is the hardware layer, which mainly includes hardware resources such as the central processing unit (CPU), memory, hard disk and network card. Server virtualization is to implement a virtualized operating environment of multiple virtual machines (VM) on a physical server with the help of virtualization software (such as VMWare ESX, Citrix XEN). The software layer installed on the server to implement the virtualization environment is called a virtual machine monitor (VMM). The VMM running on the hardware layer is responsible for scheduling, allocating and managing the hardware resources in the hardware layer. Multiple virtual machines VM run on the VMM, and the VMM provides each virtual machine with a virtualized CPU, memory, storage, IO devices (such as network card) and Ethernet switch and other hardware environments to ensure that multiple virtual machines run in isolation from each other.

In a virtualized operating environment, the VMM creates a virtual network interface card (vNIC) for each virtual machine. The virtual switch VSwitch provides communication capabilities between virtual machines and between virtual machines and external networks. Each virtual machine's virtual network card corresponds to a logical port on the VSwitch, and the host's physical network card corresponds to the port connecting the VSwitch to the external physical switch. When data packets sent or received by the virtual machine pass through the VMM, the virtual network function module in the VMM performs network function processing on the passing data. Since the virtual network function module is a software module and can be updated as needed, the virtual network function module in the VMM can provide users with a rich set of network functions.

The network port virtualization capability of a physical network card can be achieved through Single Root Input/Output Virtualization (SR-IOV) or Multi Root Input/Output Virtualization (MR-IOV). The embodiments of the present invention use SR-IOV technology as an example to illustrate. SR-IOV technology is a hardware-based virtualization solution that can efficiently share PCIe (Peripheral Component Interconnect Express) devices between virtual machines. Because SR-IOV technology is implemented in hardware, it can achieve efficient I/O performance.

The SR-IOV specification is defined by the Peripheral Component Interconnect Special Interest Group (PCI-SIG), a standards organization. The SR-IOV specification can be found at http://www.pcisig.com.

By using SR-IOV technology, a single I/O resource can be shared by multiple virtual machines on a host, allowing each virtual machine to access the same hardware resources. Therefore, an SR-IOV-enabled PCIe device (such as a physical network card's network port) can be displayed as multiple separate devices, each with its own independent PCIe configuration space. Taking an SR-IOV-enabled physical network card as an example, the card contains several network ports, and SR-IOV can be enabled/disabled for each port. An SR-IOV-enabled network port corresponds to at least one physical function (PF) and multiple virtual functions (VFs). According to the existing SR-IOV specification, each PF can have up to 64,000 associated VFs. After creating a VF, it can be directly assigned to a virtual machine on the host, allowing multiple virtual machines to share a PCIe device through at least one VF connected to it.

As shown in Figure 1B, it is a schematic diagram of the virtualization structure on the host in a network card pass-through scenario provided by an embodiment of the present invention. Unlike Figure 1A, the physical network card supports single-root IO virtualization. One network port of the physical network card corresponds to at least one PF and multiple VFs, and each VF can share the physical resources of the physical network card (such as the network card port).

When a virtual machine on a host sends packets through a passthrough VF, the packets are passed directly to the NIC's VF via the VF driver installed on the VM. This prevents the packets from passing through the virtual network function module in the VMM. Because the NIC's switching device has limited MAC table capacity and processing power, and lacks flexible functional expansion, the NIC cannot provide rich network functions. In one possible scenario, the switching device is a virtual Ethernet bridge and classifier.

It should be noted that the embodiment of the present invention is aimed at the scenario of network card pass-through, and the above network card pass-through can be implemented through SR-IOV or MR-IOV, which is not limited in the embodiment of the present invention.

As shown in Figure 2, another schematic diagram of a virtualization architecture on a host provided for the implementation of the present invention includes a virtual machine (VMM) and at least one physical network card (NIC), on which at least one virtual machine (VM) is running. The at least one physical NIC includes at least three network ports, wherein the first and second network ports support NIC virtualization capabilities, and the third network port is connected to a physical switch outside the host and is responsible for sending and receiving network traffic across the host. The first network port virtualizes at least one PF and at least two VFs (two VFs are used as an example in Figure 2). The first and second virtual machines are installed with VF drivers, and the first and second virtual machines are each connected to at least one VF. The first and second network ports are directly connected via a network cable, and the PF of the second network port is connected to a VLAN sub-interface on the VMM. Therefore, all traffic emitted from the virtual machine will be routed to the second network port via a networking cable, which will then direct the traffic back to the virtual network function module in the VMM. The network cable can be a cable made of various media, including twisted pair, optical fiber, and coaxial cable. In the embodiment of the present invention, a first network port and a second network port are directly connected through a network cable, so that data packets sent by a virtual machine connected to the VF of the first network port are forcibly forwarded to the second network port, so that the data packet transmission path must pass through the virtual network function module on the VMM, thereby realizing rich virtual network functions provided by the virtual network function module in the VMM on the basis of direct pass-through of the network card.

Those skilled in the art will understand that Figure 2 only takes two VFs and two VLAN sub-interfaces as an example. In actual product implementation, a network card that supports the network card virtualization function can be virtualized into at least one PF and multiple VFs, and is not limited to two. The corresponding number of VLAN sub-interfaces is also not limited to two.

In various embodiments of the present invention, network card virtualization specifically refers to network card hardware virtualization.

In various embodiments of the present invention, the first network port is referred to as a direct network port, the second network port is referred to as a detour network port, and the third network port is referred to as a service network port.

The pass-through network port uses standard SR-IOV/MR-IOV technology to pass the VF directly to the virtual machine, and sets different virtual local area network (VLAN) identifiers for different VFs to avoid direct communication between multiple virtual machines using the VF of this network port, and force the virtual machine's data packets to be sent from the network cable. Specifically, since a VLAN identifier represents a broadcast domain, when different VFs are set to different VLAN identifiers, the VFs connected to each virtual machine are in different broadcast domains. Since broadcast messages can only be sent to virtual machines in one VLAN, by setting different VLAN identifiers for each VF, the broadcast messages sent by the virtual machine can only be received by the virtual machine itself and the PF. When setting the VLAN identifier of the VF, it is only necessary to ensure that the VLAN identifier is unique within the host range. The VLAN identifiers on different hosts can be the same.

Create VLAN subinterfaces on the VMM. The number of VLAN subinterfaces matches the number of VFs on the passthrough network port, and the VLAN IDs of the VLAN subinterfaces correspond one-to-one with the VLAN IDs of the VFs on the passthrough network port. The network port on the detour network port connected to the passthrough network port can be a PF or a VF set to promiscuous mode. The VLAN subinterface is a virtual bridge with Layer 2 forwarding capabilities.

It should be noted that in the embodiment shown in Figure 2, the transmission of a data packet from the first virtual machine to the second virtual machine represents communication between two virtual machines within the same host. Those skilled in the art will appreciate that the second virtual machine and the first virtual machine may also be located on different hosts, in which case the communication between the first and second virtual machines is cross-host communication.

In conjunction with the virtualization structure of the host shown in FIG2 , the embodiment of the present invention uses the example of a first virtual machine sending a data packet to a second virtual machine to illustrate the data packet processing process. The first virtual machine sends a data packet to the second virtual machine through the VF connected to itself. The data packet carries the VLAN ID of the VF that sent the data packet. The switching device of the first network port receives the data packet and forcibly forwards the data packet to the second network port through the network cable. The switching device of the second network port sends the data packet to a VLAN sub-interface with the same VLAN ID as the data packet based on the VLAN ID carried by the data packet. The VLAN sub-interface receives the data packet, removes the VLAN ID of the data packet, and sends the data packet to the virtual network function module. The virtual network function module performs network function processing on the modified data packet and then sends the processed data packet to the second virtual machine. In the scenario of network card direct pass, after the virtual machine sends the data packet from the direct pass VF, the data packet can be sent to the virtual network function module in the VMM through the above method. The software module is used to provide users with rich virtual network functions and implement virtual network function processing of data packets.

In the process of sending a data packet from the first virtual machine to the second virtual machine, the VLAN ID of the VF connected to the first virtual machine is the same as the VLAN ID of the corresponding VLAN sub-interface in the VMM. As shown in Figure 3, a schematic diagram of a virtual machine creation process provided by an embodiment of the present invention is used to create a virtual machine with a pass-through VF and create a VLAN sub-interface corresponding to the pass-through VF.

Step 301: The computing management module receives a virtual machine creation request, where the virtual machine creation request is used to create a virtual machine with a pass-through VF.

In one scenario, the virtual machine creation process can be initiated by an administrator or user. The administrator or user logs in to the external interface of the cloud management platform through a terminal, selects the specifications of the virtual machine to be created, and initiates a virtual machine creation request to the computing management module. The virtual machine creation request carries parameters of the virtual machine to be created, including information indicating that the virtual machine to be created has a passthrough VF.

Step 302: The computing management module sends an allocation request to the device management module, requesting that a VF be allocated for the virtual machine to be created;

Step 303: The device management module returns an identifier of an idle VF to the computing management module. The idle VF is a VF on the host that has not been allocated to a virtual machine.

Step 304: The computing management module assigns a VLAN ID to the VF;

Step 305: The computing management module sends the VLAN ID to the device management module, and the device management module configures the VLAN ID to the allocated VF;

Step 306: The device management module sends information for creating a virtual machine to the VMM, where the information for creating a virtual machine includes a VF identifier.

Step 306: The VMM creates a virtual machine and sets the VF as the direct network port of the virtual machine;

Step 307: After the virtual machine is successfully created, the computing management module sends a VLAN sub-interface creation request to the device management module. The VLAN sub-interface creation request carries the VLAN ID of the VF.

Step 308: The device management module receives the VLAN sub-interface creation request, creates a VLAN sub-interface corresponding to the VF on the VMM, and configures the VLAN ID of the VLAN sub-interface to be the same as that of the VF.

It should be noted that a VLAN sub-interface is a virtual network device provided by the Linux system and can be created directly through the ip command of the Linux system. For example, the command to create a VLAN sub-interface with VLAN ID 100 is as follows: ip linkadd link eth0 name vlan100 type vlan id 100

Step 309: The computing management module receives the VLAN sub-interface creation response message, sends a notification message to the network management module, and connects the created VLAN sub-interface to the bridge corresponding to the virtual network management module.

It should be noted that a virtual machine can have multiple pass-through VFs. The specific creation process is similar to the above steps, but each pass-through VF will be set with a different VLAN ID, and a VLAN sub-interface corresponding to each pass-through VF will be created on the VMM.

As shown in FIG4 , it is a flow chart of a method for processing messages in a cloud computing system provided by an embodiment of the present invention. The embodiment of the present invention is described by taking the communication between the first virtual machine on host A and the second virtual machine on host B as an example.

Step 401: The first virtual machine on host A sends a data packet through the VF connected to itself. The destination address of the data packet is the address of the second virtual machine. The data packet carries the VLAN ID of the VF that sends the data packet.

Step 402: After receiving the data packet, the switching device (first switching device) of the direct network port broadcasts the received data packet. Since the VLAN IDs of the VFs on the direct network port are different and the VFs are located in different virtual local area networks, other VFs on the direct network port will not receive the broadcasted data. The data packet is forcibly sent to the detour network port via the network cable.

It should be noted that the through-port and the detour port are in Virtual Ethernet Port Aggregator (VEPA) mode, and the VEPA mode is used to instruct the through-port and the detour port to forcibly forward received data packets. The VEPA mode is defined by the IEEE802.1Qbg standard.

Step 403: The switching device of the detour network port (the second switching device) receives the data packet from the direct network port and sends the data packet to the VLAN sub-interface with the same VLAN ID on the VMM according to the VLAN ID carried in the data packet.

Step 404: The VLAN sub-interface receives the data packet, removes the VLAN identifier of the data packet, and sends the data packet to the first virtual network function module;

Step 405: After the first virtual network function module performs network function processing on the data packet, it sends the data packet to the service network port. The service network port of host A sends the received data packet to the network outside host A. The data packet is routed to the service network port of host B where the second virtual machine is located. After receiving the data packet, the service network port of host B sends the data packet to the virtual network function module of host B.

Specifically, a tunnel can be established between the first virtual network function module of host A and the second virtual network function module of host B, and the data packet is transmitted to the virtual network function module of host B through the network between host A and host B through tunnel technology.

Step 406: After the second virtual network function module on host B performs network function processing, the data packet is sent to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, wherein the VF connected to the second virtual machine and the VLAN sub-interface receiving the data packet have the same VLAN ID.

It should be noted that in one possible scenario, a VLAN subinterface is connected to a software-implemented virtual bridge, which provides Layer 2 forwarding capabilities and sends packets to the VLAN subinterface. Because the VLAN subinterface and the corresponding VF are set to the same VLAN ID, the VF that is directly connected to the second virtual machine can receive the packets.

Step 407: The VLAN sub-interface adds a VLAN identifier to the data packet, where the VLAN identifier is the VLAN identifier of the VLAN sub-interface, and sends the data packet to the detour network port. Because each VLAN sub-interface connected to the detour network port has a different VLAN identifier, the switching device (the fourth switching device) of the detour network port forcibly forwards the data packet to the pass-through network port via the network cable.

Step 408: The switching device of the direct network port (the third switching device) sends the data packet to the VF identified by the VLAN ID according to the VLAN ID carried by the data packet;

Step 409: The VF removes the VLAN ID of the data packet and sends the data packet to the second virtual machine.

It should be noted that in the embodiments of the present invention, the direct network port, the bypass network port, and the service network port can be located on the same network card or on different network cards, and this is not limited in the embodiments of the present invention. Furthermore, when the direct network port and the bypass network port are located on the same network card, the direct network card and the bypass network port can each have independent switching devices, or the direct network port and the bypass network port can share the same switching device.

It should be noted that, in a specific implementation scenario, the VLAN sub-interface in the embodiment of the present invention may be OpenVswitch.

In an embodiment of the present invention, each VF of the direct network port has a different VLAN ID, and a VLAN sub-interface corresponding to the VF of the direct network port is set on the VMM. Each VLAN sub-interface has the same VLAN ID as the corresponding VF. After the virtual machine sends a data packet from the VF, the data packet carries the VLAN ID of the VF. Since the direct network port and the detour network port are directly connected through a network cable, the data packet will be forcibly forwarded to the switching device of the detour network port. The switching device of the detour network port sends the data packet to the VLAN sub-interface with the same VLAN ID according to the VLAN ID carried by the data packet, so that the data packet is sent to the VMM, and then the virtual machine network function module in the VMM performs network function processing and sends the processed data packet to the second virtual machine. In the above manner, in the scenario of direct network card, the data packet is sent to the virtual network function module in the VMM, and the flexibility of network functions is realized by software, providing rich network functions.

The embodiment corresponding to FIG4 illustrates a data packet transmission process between two virtual machines on two hosts. Those skilled in the art will appreciate that the source and destination virtual machines of a data packet can be located on the same host. In this case, after the virtual network function module on the host performs network function processing on the data packet, it sends the processed data packet to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, and the data packet is then sent to the second virtual machine through the VLAN sub-interface.

The host and cloud management platform can use general computer equipment, for example,

As shown in FIG5 , which is a schematic diagram of the hardware structure of a computer device provided in an embodiment of the present invention, the computer device 500 includes at least one processor 501 , a communication bus 502 , a memory 503 , and at least one communication interface 504 .

The processor 501 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention.

The communication bus 502 may include a path for transmitting information between the aforementioned components. The communication interface 504 may be any transceiver or similar device for communicating with other devices or communication networks, such as Ethernet, a radio access network (RAN), or a wireless local area network (WLAN).

The memory 503 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory can be independent and connected to the processor via a bus. The memory can also be integrated with the processor.

The memory 503 is used to store application code for executing the solution of the present invention, and the execution is controlled by the processor 501. The processor 501 is used to execute the application code stored in the memory 503.

In a specific implementation, as an embodiment, the processor 501 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 5 .

In a specific implementation, as an embodiment, the computer device 500 may include multiple processors, such as processor 501 and processor 508 in FIG5 . Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).

In a specific implementation, as an embodiment, the computer device 500 may further include an output device 505 and an input device 506. The output device 505 communicates with the processor 501 and can display information in a variety of ways. For example, the output device 505 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 506 communicates with the processor 501 and can receive user input in a variety of ways. For example, the input device 506 can be a mouse, a keyboard, a touch screen device, or a sensor device.

The computer device 500 described above can be a general-purpose computer device or a dedicated computer device. In a specific implementation, the computer device 500 can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, an embedded device, or a device having a similar structure to that shown in FIG5 . The embodiment of the present invention does not limit the type of the computer device 500.

The cloud management platform and the host in Figure 2 may be the devices shown in Figure 5 , with one or more software modules stored in the memory for implementing the various functions of the host and the cloud management platform. The host and the cloud management platform may implement the message processing method disclosed in the embodiments of the present invention through the processor and the program code in the memory.

It should be noted that the computer device shown in Figure 5 only provides possible hardware implementation methods for various parts of the cloud computing system. According to the differences or changes in the functions of various parts of the system, the hardware components of the computer device can be added or deleted to match the functions of various parts of the system.

Furthermore, similar to the hardware device shown in Figure 5, the network card in the above embodiment includes a processor and a memory, and the processor in the network card executes instructions in the memory to implement the functions of the above switching device.

Furthermore, as shown in FIG6 , which is a schematic diagram of a cloud computing system structure provided by an embodiment of the present invention, the cloud computing system includes at least one host 601 and a cloud management platform 602 . The structure of the host 601 is shown in FIG2 .

The host 601 includes a virtual machine monitor (VMM) and at least one network card. A first virtual machine runs on the host 601. The VMM includes multiple VLAN sub-interfaces and a virtual network function module. The at least one network card includes a switching device and at least three network ports. The first network port and the second network port support network card virtualization capabilities. The first network port corresponds to at least one PF and multiple VFs. The multiple VFs are configured with VLAN identifiers, and the VLAN identifiers of the VFs are different. The first virtual machine is connected to at least one VF of the first network port. The number of VLAN sub-interfaces is the same as the number of VFs of the first network port and corresponds one-to-one. The VLAN sub-interfaces and their corresponding VFs have the same VLAN identifier. The first network port and the second network port are connected via a network cable.

The cloud management platform 602 is configured to create the first virtual machine on the host, and after the first virtual machine is successfully created, notify the VMM of the host to create a VLAN sub-interface corresponding to the VF of the first virtual machine, wherein the VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN ID as the VF of the first virtual machine;

The first virtual machine is configured to send a data packet to the second virtual machine through the VF connected to the first virtual machine, where the data packet carries a VLAN identifier of the VF that sends the data packet and an address of the second virtual machine;

The switching device of the first network port is configured to receive the data packet and forcibly forward the data packet to the second network port through the network cable;

The switching device of the second network port is configured to receive a data packet from the first network port, and send the data packet to a VLAN sub-interface having the same VLAN ID as the data packet according to the VLAN ID carried by the data packet;

The VLAN sub-interface is used to receive the data packet, remove the VLAN identifier of the data packet, and send the data packet to the virtual network function module;

The virtual network function module is used to perform network function processing on the modified data packet and then send the processed data packet, where the destination address of the processed data packet is the address of the second virtual machine.

Embodiments of the present invention further provide a computer storage medium for storing computer software instructions for the apparatus of Figures 2-6, including a program designed to execute the method embodiments described above. By executing the stored program, the method for message processing in a cloud computing system can be implemented.

The method, host, and system for message processing in a cloud computing system provided by an embodiment of the present invention are applied to a scenario where a network card is passed through. After a virtual machine sends a data packet from a passed-through VF, the data packet can be sent to a virtual network function module in the VMM through the message processing process disclosed in the embodiment of the present invention. This software module is used to provide users with rich network functions and implement network function processing of the data packet.

Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed embodiments of the invention, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps. A single processor or other unit may implement several functions listed in the claims. The fact that certain measures are recited in different dependent claims does not mean that these measures cannot be combined to produce good results.

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, devices (equipment), or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The computer program may be stored/distributed in a suitable medium, provided together with other hardware or as part of the hardware, or in other distributed forms, such as via the Internet or other wired or wireless telecommunications systems.

The computer program instructions involved in the embodiments of the present invention may be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner. By executing the computer program instructions, the functions of the components in the aforementioned embodiments can be realized.

These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

Although the present invention has been described with reference to specific features and embodiments thereof, it will be apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the invention. It will be apparent that various modifications and variations may be made to the present invention by those skilled in the art without departing from the spirit and scope of the invention. Thus, the present invention is intended to encompass such modifications and variations as fall within the scope of the claims and their equivalents.

Claims (20)

1. A host, characterized in that the host includes a Virtual Machine Monitor (VMM) and at least one network interface card (NIC), the host runs a first virtual machine, the VMM includes multiple VLAN sub-interfaces and a virtual network function module, the at least one NIC includes a switching device and at least three network ports, wherein the first network port and the second network port support NIC virtualization capabilities, the first network port corresponds to at least one physical function (PF) and multiple virtual function (VF), the multiple VFs are configured with virtual local area network (VLAN) identifiers, and the VLAN identifiers of each VF are different, the first virtual machine is connected to at least one VF of the first network port, the number of VLAN sub-interfaces is the same as the number of VFs of the first network port and corresponds one-to-one, the VLAN sub-interfaces and their corresponding VFs have the same VLAN identifiers, and the first network port and the second network port are connected via network cables. The first virtual machine is used to send data packets to the second virtual machine through the VF connected to it. The data packets carry the VLAN identifier of the VF that sent the data packets and the address of the second virtual machine. The switching device of the first network port is used to receive the data packet and forcibly forward the data packet to the second network port through the network cable; The switching device of the second network port is used to receive data packets from the first network port and send the data packets to the VLAN sub-interface identified by the VLAN identifier carried by the data packets. The VLAN sub-interface is used to receive the data packet, remove the VLAN identifier from the data packet, and send the data packet to the virtual network function module; The virtual network function module is used to perform network function processing on the modified data packet and then send the processed data packet. The destination address of the processed data packet is the address of the second virtual machine. 2. The host as described in claim 1, wherein the mode of the first network port and the second network port is Virtual Ethernet Port Aggregation (VEPA) mode. 3. The host computer as described in claim 1 or 2, characterized in that the host computer further includes a device management module. The device management module is used to receive a VLAN sub-interface creation request sent by the cloud management platform after the first virtual machine is successfully created. The VLAN sub-interface creation request carries the VLAN identifier of the VF assigned to the first virtual machine. The device management module is also used to send a notification message to the VMM to notify the VMM to create a VLAN sub-interface corresponding to the VF of the first virtual machine, wherein the VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN identifier as the VF of the first virtual machine. 4. The host computer as described in claim 1 or 2, characterized in that, The first network port, the second network port, and the third network port are located on the same network card; or, The first network port, the second network port, and the third network port are located on two or three network cards; or, The first network port and the second network port are located on the same network interface card (NIC), and the first network port and the second network port share the switching equipment of the same NIC; or, The first network port and the second network port are located on the same network card, and the switching devices of the first network port and the second network port are independent of each other. 5. The host as described in claim 1 or 2, wherein the second virtual machine and the first virtual machine are located on the same host. 6. The host computer as described in claim 5, characterized in that, The virtual network function module is also used to send the processed data packet to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, wherein the VF connected to the second virtual machine and the VLAN sub-interface receiving the processed data packet have the same VLAN identifier. The VLAN sub-interface corresponding to the VF connected to the second virtual machine is used to add its own VLAN identifier to the data packet and send the data packet to the second network port; The switching device of the second network port is also used to forcibly forward the data packet to the first network port via the network cable; The switching device of the first network port is also used to send the data packet to the VF identified by the VLAN identifier in the data packet according to the VLAN identifier carried in the data packet, so that the data packet is transmitted to the second virtual machine. 7. The host as described in claim 1 or 2, wherein the second virtual machine and the first virtual machine are located on different hosts. The virtual network function module is specifically used to establish a tunnel with another virtual network function module on the host where the second virtual machine is located, and send the processed data packet to an external physical switch through a third network port. The external physical switch then sends the processed data packet to the host where the second virtual machine is located, so that the other virtual network function module sends the processed data packet to the second virtual machine. 8. A method for message processing in a cloud computing system, characterized in that at least one host in the cloud computing system includes a Virtual Machine Monitor (VMM) and at least one network interface card (NIC), the host runs a first virtual machine, the VMM includes multiple VLAN sub-interfaces and a virtual network function module, the at least one NIC includes a switching device and at least three network ports, wherein the first network port and the second network port support NIC virtualization capabilities, the first network port corresponds to at least one physical function (PF) and multiple virtual function (VF), the multiple VFs are configured with VLAN identifiers, and the VLAN identifiers of each VF are different, the first virtual machine is connected to at least one VF of the first network port, the number of VLAN sub-interfaces is the same as the number of VFs of the first network port and corresponds one-to-one, the VLAN sub-interfaces and their corresponding VFs have the same VLAN identifiers, the first network port and the second network port are connected by a network cable, the method includes: The first virtual machine sends a data packet to the second virtual machine through the VF connected to it. The data packet carries the VLAN identifier of the VF that sent the data packet and the address of the second virtual machine. The switching device at the first network port receives the data packet and forcibly forwards the data packet to the second network port via the network cable; The switching device of the second network port receives data packets from the first network port and sends the data packets to the VLAN sub-interface identified by the VLAN identifier carried in the data packets. The VLAN sub-interface receives the data packet, removes the VLAN identifier from the data packet, and sends the data packet to the virtual network function module; After performing network function processing on the modified data packet, the virtual network function module sends the processed data packet, and the destination address of the processed data packet is the address of the second virtual machine. 9. The method as described in claim 8, wherein the mode of the first network port and the second network port is Virtual Ethernet Port Aggregation (VEPA) mode. 10. The method as described in claim 8 or 9, wherein the host further includes a device management module, and the method further includes: After the first virtual machine is successfully created, the device management module receives a VLAN sub-interface creation request sent by the cloud management platform. The VLAN sub-interface creation request carries the VLAN identifier of the VF assigned to the first virtual machine. The device management module sends a notification message to the VMM so that the VMM creates a VLAN sub-interface corresponding to the VF of the first virtual machine, and the VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN identifier as the VF of the first virtual machine. 11. The method as described in claim 8 or 9, characterized in that, The first network port, the second network port, and the third network port are located on the same network card; or, The first network port, the second network port, and the third network port are located on two or three network cards; or, The first network port and the second network port are located on the same network interface card (NIC), and the first network port and the second network port share the switching equipment of the same NIC; or, The first network port and the second network port are located on the same network card, and the switching devices of the first network port and the second network port are independent of each other. 12. The method as described in claim 8 or 9, wherein the second virtual machine and the first virtual machine are located on the same host. 13. The method as described in claim 12, wherein sending the processed data packet to the second virtual machine comprises: The virtual network function module sends the processed data packet to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, wherein the VF connected to the second virtual machine and the VLAN sub-interface receiving the processed data packet have the same VLAN identifier. The VLAN sub-interface corresponding to the VF connected to the second virtual machine adds its own VLAN identifier to the processed data packet and sends the processed data packet to the second network port; The switching device of the second network port forcibly forwards the processed data packet to the first network port through the network cable; The switching device of the first network port sends the data packet to the VF identified by the VLAN identifier carried in the processed data packet, thereby enabling the data packet to be transmitted to the second virtual machine. 14. The method as described in claim 8 or 9, wherein the method for the virtual network function module to send the processed data packet further includes: The virtual network function module establishes a tunnel with another virtual network function module on the host where the second virtual machine is located, and sends the processed data packet to an external physical switch through a third network port. The external physical switch then sends the processed data packet to the host where the second virtual machine is located, so that the other virtual network function module sends the processed data packet to the second virtual machine. 15. A cloud computing system, characterized in that it includes a cloud management platform and at least one host, the host including a Virtual Machine Monitor (VMM) and at least one network interface card (NIC), the host running a first virtual machine, the VMM including multiple VLAN sub-interfaces and a virtual network function module, the at least one NIC including a switching device and at least three network ports, wherein the first network port and the second network port support NIC virtualization capabilities, the first network port corresponds to at least one physical function (PF) and multiple virtual function (VF), the multiple VFs are configured with VLAN identifiers, and the VLAN identifiers of each VF are different, the first virtual machine is connected to at least one VF of the first network port, the number of VLAN sub-interfaces is the same as the number of VFs of the first network port and corresponds one-to-one, the VLAN sub-interfaces and their corresponding VFs have the same VLAN identifiers, and the first network port and the second network port are connected by a network cable. The cloud management platform is used to create the first virtual machine on the host. After the first virtual machine is successfully created, it notifies the host's VMM to create a VLAN sub-interface corresponding to the VF of the first virtual machine. The VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN identifier as the VF of the first virtual machine. The first virtual machine is used to send data packets to the second virtual machine through the VF connected to it. The data packets carry the VLAN identifier of the VF that sent the data packets and the address of the second virtual machine. The switching device of the first network port is used to receive the data packet and forcibly forward the data packet to the second network port through the network cable; The switching device of the second network port is used to receive data packets from the first network port and send the data packets to a VLAN sub-interface with the same VLAN identifier as the data packets according to the VLAN identifier carried by the data packets; The VLAN sub-interface is used to receive the data packet, remove the VLAN identifier from the data packet, and send the data packet to the virtual network function module; The virtual network function module is used to perform network function processing on the modified data packet and then send the processed data packet. The destination address of the processed data packet is the address of the second virtual machine. 16. The system as described in claim 15, wherein the mode of the first network port and the second network port is Virtual Ethernet Port Aggregation (VEPA) mode. 17. The system as described in claim 15 or 16, wherein the host further comprises a device management module. The device management module is used to receive a VLAN sub-interface creation request sent by the cloud management platform after the first virtual machine is successfully created. The VLAN sub-interface creation request carries the VLAN identifier of the VF assigned to the first virtual machine. The device management module is also used to send a notification message to the VMM to notify the VMM to create a VLAN sub-interface corresponding to the VF of the first virtual machine, wherein the VLAN sub-interface corresponding to the VF of the first virtual machine has the same VLAN identifier as the VF of the first virtual machine. 18. The system as described in claim 15 or 16, wherein the second virtual machine and the first virtual machine reside on the same host. The virtual network function module is also used to send the processed data packet to the VLAN sub-interface corresponding to the VF connected to the second virtual machine, wherein the VF connected to the second virtual machine and the VLAN sub-interface receiving the processed data packet have the same VLAN identifier. The VLAN sub-interface corresponding to the VF connected to the second virtual machine is used to add its own VLAN identifier to the data packet and send the data packet to the second network port; The switching device of the second network port is also used to forcibly forward the data packet to the first network port via the network cable; The switching device of the first network port is also used to send the data packet to the VF identified by the VLAN identifier in the data packet according to the VLAN identifier carried in the data packet, so that the data packet is transmitted to the second virtual machine. 19. The system as described in claim 15 or 16, wherein the second virtual machine and the first virtual machine are located on different hosts. The virtual network function module is specifically used to establish a tunnel with another virtual network function module on the host where the second virtual machine is located, and send the processed data packet to an external physical switch through a third network port. The external physical switch then sends the processed data packet to the host where the second virtual machine is located, so that the other virtual network function module sends the processed data packet to the second virtual machine. 20. A host computer, characterized in that it comprises a first processor, a first memory, and at least one network interface card (NIC), the NIC comprising a second processor, a second memory, and at least two network ports, wherein the first and second network ports of the at least one NIC support NIC virtualization capabilities, the first network port corresponds to at least one physical function (PF) and multiple virtual function (VF), the multiple VFs are configured with VLAN identifiers, and the VLAN identifiers of each VF are different from each other, the first memory and the second memory store instructions, the first processor executes a first instruction in the first memory to implement the function of a first virtual machine, the first virtual machine is connected to at least one VF of the first network port, the first processor executes a second instruction in the first memory to implement the function of a VLAN sub-interface, the first processor executes a third instruction in the first memory to implement the function of a virtual network function module, and the second processor is used to execute instructions in the second memory to implement the function of a switching device. The first virtual machine is connected to at least one Virtual Function (VF) on the first network port. The host contains multiple VLAN sub-interfaces, the number of which is the same as the number of VFs on the first network port and corresponds one-to-one. Each VLAN sub-interface and its corresponding VF have the same VLAN identifier. The first network port and the second network port are connected via a network cable. The first processor is configured to execute a first instruction in the first memory to perform the step of: sending a data packet to a second virtual machine via the VF connected to itself, the data packet carrying the VLAN identifier of the VF that sent the data packet and the address of the second virtual machine; The second processor is used to execute instructions in the second memory to perform the following steps: receiving the data packet and forcibly forwarding the data packet to the second network port via the network cable; The second processor is used to execute instructions in the second memory to perform the following steps: receiving a data packet from the first network port, and sending the data packet to the VLAN sub-interface identified by the VLAN identifier according to the VLAN identifier carried by the data packet; The first processor is configured to execute a second instruction in the first memory to perform the steps of: receiving the data packet, removing the VLAN identifier from the data packet, and sending the data packet to the virtual network function module; The first processor is configured to execute a third instruction in the first memory to perform the following steps: after performing network function processing on the modified data packet, send the processed data packet to the second virtual machine according to the address of the second virtual machine.