NetBricks: Taking the V out of NFV Aurojit Panda, Sangjin Han, Keon - - PowerPoint PPT Presentation

▶
netbricks taking the v out of nfv
SMART_READER_LITE
LIVE PREVIEW

NetBricks: Taking the V out of NFV Aurojit Panda, Sangjin Han, Keon - - PowerPoint PPT Presentation

Jan 25, 2024 336 likes •1.14k views

NetBricks: Taking the V out of NFV Aurojit Panda, Sangjin Han, Keon Jang, Melvin Walls, Sylvia Ratnasamy, Scott Shenker UC Berkeley, Google, ICSI What the heck is NFV? A Short Introduction to NFV A Short Introduction to NFV Firewall IDS

slide-1
SLIDE 1

NetBricks: Taking the V out of NFV

Aurojit Panda, Sangjin Han, Keon Jang, Melvin Walls, Sylvia Ratnasamy, Scott Shenker UC Berkeley, Google, ICSI

slide-2
SLIDE 2

What the heck is NFV?

slide-3
SLIDE 3

A Short Introduction to NFV

slide-4
SLIDE 4

A Short Introduction to NFV

Firewall IDS Cache LB

slide-5
SLIDE 5

A Short Introduction to NFV

Network Function Chain

Firewall IDS Cache LB

slide-6
SLIDE 6

Why NFV?

  • Simplifies adding new functionality: Deploy new software.
slide-7
SLIDE 7

Why NFV?

  • Simplifies adding new functionality: Deploy new software.
  • Simplifies developing new functionality: Write software vs design hardware
slide-8
SLIDE 8

Why NFV?

  • Simplifies adding new functionality: Deploy new software.
  • Simplifies developing new functionality: Write software vs design hardware
  • Reuse management tools from other domains.
slide-9
SLIDE 9

Why NFV?

  • Simplifies adding new functionality: Deploy new software.
  • Simplifies developing new functionality: Write software vs design hardware
  • Reuse management tools from other domains.
  • Consolidation: Reduce number of hardware boxes in the network.
slide-10
SLIDE 10

Challenges for NFV

slide-11
SLIDE 11
  • Running NFs
  • Isolation and Performance

Challenges for NFV

slide-12
SLIDE 12
  • Running NFs
  • Isolation and Performance
  • Building NFs
  • High-Level Programming and Performance

Challenges for NFV

slide-13
SLIDE 13

Running NFs

slide-14
SLIDE 14

Isolation

  • Memory Isolation: Each NF’s memory cannot be accessed by other NFs.
slide-15
SLIDE 15

Isolation

  • Memory Isolation: Each NF’s memory cannot be accessed by other NFs.
  • Packet Isolation: When chained, each NF processes packets in isolation.
slide-16
SLIDE 16

Isolation

  • Memory Isolation: Each NF’s memory cannot be accessed by other NFs.
  • Packet Isolation: When chained, each NF processes packets in isolation.
slide-17
SLIDE 17

Isolation

  • Memory Isolation: Each NF’s memory cannot be accessed by other NFs.
  • Packet Isolation: When chained, each NF processes packets in isolation.
  • Performance Isolation: One NF does not affect another’s performance.
slide-18
SLIDE 18

Isolation

  • Memory Isolation: Each NF’s memory cannot be accessed by other NFs.
  • Packet Isolation: When chained, each NF processes packets in isolation.
  • Performance Isolation: One NF does not affect another’s performance.
slide-19
SLIDE 19

Current Solution

NIC NIC ... Memory Isolation Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-20
SLIDE 20

Current Solution

NIC NIC ... Memory Isolation Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-21
SLIDE 21

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-22
SLIDE 22

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-23
SLIDE 23

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-24
SLIDE 24

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-25
SLIDE 25

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-26
SLIDE 26

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

slide-27
SLIDE 27

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

Copy

slide-28
SLIDE 28

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

Copy

slide-29
SLIDE 29

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation vSwitch

VM/Container VM/Container VM/Container

Copy

slide-30
SLIDE 30

Current Solution

NIC NIC ... Memory Isolation ✔ Performance Packet Isolation ✔ vSwitch

VM/Container VM/Container VM/Container

Copy

slide-31
SLIDE 31

Current Solution

NIC NIC ... Memory Isolation ✔ Performance

✗

Packet Isolation ✔ vSwitch

VM/Container VM/Container VM/Container

Copy

slide-32
SLIDE 32

Isolation Costs Performance

slide-33
SLIDE 33

Isolation Costs Performance

slide-34
SLIDE 34

Isolation Costs Performance

slide-35
SLIDE 35

Isolation Costs Performance

slide-36
SLIDE 36

Isolation Costs Performance

slide-37
SLIDE 37

Isolation Costs Performance

slide-38
SLIDE 38

NetBricks Runtime Architecture

NF A NF B NF C NF D NF X NF X NF Y NF Z NF A NF B NF C NF D NF X NF Y NF Z ZCSI Scheduler DPDK Poll for I/O DPDK Poll for I/O DPDK Poll for I/O NICs Poll for I/O NF Y NF Z NF A NF B NF C NF D Single Process Space

slide-39
SLIDE 39

NetBricks Runtime Architecture

NF A NF B NF C NF D NF X NF X NF Y NF Z NF A NF B NF C NF D NF X NF Y NF Z ZCSI Scheduler DPDK Poll for I/O DPDK Poll for I/O DPDK Poll for I/O NICs Poll for I/O Function Call NF Y NF Z NF A NF B NF C NF D Single Process Space

slide-40
SLIDE 40

NetBricks Runtime Architecture

NF A NF B NF C NF D NF X NF X NF Y NF Z NF A NF B NF C NF D NF X NF Y NF Z ZCSI Scheduler DPDK Poll for I/O DPDK Poll for I/O DPDK Poll for I/O NICs Poll for I/O NF Y NF Z NF A NF B NF C NF D Single Process Space

slide-41
SLIDE 41

NetBricks Runtime Architecture

NF A NF B NF C NF D NF X NF X NF Y NF Z NF A NF B NF C NF D NF X NF Y NF Z ZCSI Scheduler DPDK Poll for I/O DPDK Poll for I/O DPDK Poll for I/O NICs Poll for I/O NF Y NF Z Run to Completion Scheduling NF A NF B NF C NF D Single Process Space

slide-42
SLIDE 42

NetBricks Runtime Architecture

NF A NF B NF C NF D NF X NF X NF Y NF Z NF A NF B NF C NF D NF X NF Y NF Z ZCSI Scheduler DPDK Poll for I/O DPDK Poll for I/O DPDK Poll for I/O NICs Poll for I/O NF Y NF Z Run to Completion Scheduling NF A NF B NF C NF D Single Process Space

What about Isolation?

slide-43
SLIDE 43

Provide Isolation through Software

slide-44
SLIDE 44

ZCSI: Zero Copy Soft Isolation

  • VMs and containers impose cost on packets crossing isolation boundaries.
  • Frequent operation for many NFs which must support 10s of MPPS.
slide-45
SLIDE 45

ZCSI: Zero Copy Soft Isolation

  • VMs and containers impose cost on packets crossing isolation boundaries.
  • Frequent operation for many NFs which must support 10s of MPPS.
  • Insight: Use type checking (compile time) and runtime checks for isolation.
  • Isolation costs largely paid at compile time (small runtime costs).
slide-46
SLIDE 46

Our Approach

  • Disallow pointer arithmetic in NF code: use safe subset of languages.
slide-47
SLIDE 47

Our Approach

  • Disallow pointer arithmetic in NF code: use safe subset of languages.
  • Type checks + array bounds checking provide memory isolation.
slide-48
SLIDE 48

Our Approach

  • Disallow pointer arithmetic in NF code: use safe subset of languages.
  • Type checks + array bounds checking provide memory isolation.
  • Build on unique types for packet isolation.
slide-49
SLIDE 49

Our Approach

  • Disallow pointer arithmetic in NF code: use safe subset of languages.
  • Type checks + array bounds checking provide memory isolation.
  • Build on unique types for packet isolation.
  • Unique types ensure references destroyed after certain calls.
slide-50
SLIDE 50

Our Approach

  • Disallow pointer arithmetic in NF code: use safe subset of languages.
  • Type checks + array bounds checking provide memory isolation.
  • Build on unique types for packet isolation.
  • Unique types ensure references destroyed after certain calls.
  • Ensure only one NF has a reference to a packet.
slide-51
SLIDE 51

Our Approach

  • Disallow pointer arithmetic in NF code: use safe subset of languages.
  • Type checks + array bounds checking provide memory isolation.
  • Build on unique types for packet isolation.
  • Unique types ensure references destroyed after certain calls.
  • Ensure only one NF has a reference to a packet.
  • Enables zero copy packet I/O.
slide-52
SLIDE 52

Our Approach

  • Disallow pointer arithmetic in NF code: use safe subset of languages.
  • Type checks + array bounds checking provide memory isolation.
  • Build on unique types for packet isolation.
  • Unique types ensure references destroyed after certain calls.
  • Ensure only one NF has a reference to a packet.
  • Enables zero copy packet I/O.
  • All of these features implemented on top of Rust.
slide-53
SLIDE 53

Software can provide both Memory and Packet Isolation

slide-54
SLIDE 54

Benefits of Software Isolation

  • Enable better consolidation: multiple NFs can share a core.
slide-55
SLIDE 55

Benefits of Software Isolation

  • Enable better consolidation: multiple NFs can share a core.
  • Normally hard because of context switch costs (~1µs).
slide-56
SLIDE 56

Benefits of Software Isolation

  • Enable better consolidation: multiple NFs can share a core.
  • Normally hard because of context switch costs (~1µs).
  • In our case just a function call (a few cycles at most).
slide-57
SLIDE 57

Benefits of Software Isolation

  • Enable better consolidation: multiple NFs can share a core.
  • Normally hard because of context switch costs (~1µs).
  • In our case just a function call (a few cycles at most).
  • Reduce memory and cache pressure for NFV deployments.
slide-58
SLIDE 58

Benefits of Software Isolation

  • Enable better consolidation: multiple NFs can share a core.
  • Normally hard because of context switch costs (~1µs).
  • In our case just a function call (a few cycles at most).
  • Reduce memory and cache pressure for NFV deployments.
  • Zero copy I/O => do not need to copy packets around.
slide-59
SLIDE 59
  • Running NFs
  • Isolation and Performance
  • Building NFs
  • High-Level Programming and Performance

Challenges for NFV

slide-60
SLIDE 60

How to write NFs?

  • Current: NF writers concerned about meeting performance targets
slide-61
SLIDE 61

How to write NFs?

  • Current: NF writers concerned about meeting performance targets
  • Low level abstractions (I/O, cache aware data structures) and low level code.
slide-62
SLIDE 62

How to write NFs?

  • Current: NF writers concerned about meeting performance targets
  • Low level abstractions (I/O, cache aware data structures) and low level code.
  • Spend lots of time optimizing how abstractions are used to get performance.
slide-63
SLIDE 63

How to write NFs?

  • Current: NF writers concerned about meeting performance targets
  • Low level abstractions (I/O, cache aware data structures) and low level code.
  • Spend lots of time optimizing how abstractions are used to get performance.
  • Observation: NFs exhibit common patterns: abstract and optimize these.
slide-64
SLIDE 64

How to write NFs?

  • Current: NF writers concerned about meeting performance targets
  • Low level abstractions (I/O, cache aware data structures) and low level code.
  • Spend lots of time optimizing how abstractions are used to get performance.
  • Observation: NFs exhibit common patterns: abstract and optimize these.
  • What happened in other areas
slide-65
SLIDE 65

How to write NFs?

  • Current: NF writers concerned about meeting performance targets
  • Low level abstractions (I/O, cache aware data structures) and low level code.
  • Spend lots of time optimizing how abstractions are used to get performance.
  • Observation: NFs exhibit common patterns: abstract and optimize these.
  • What happened in other areas
  • MPI to Map Reduce, etc.
slide-66
SLIDE 66

Abstractions

Packet Processing Abstractions Parse/Deparse Parse (or undo parsing for) a header from the packet. Transform Operate on the packet header and payload. Filter Drop packet whose header or payload meet some criterion. Byte Stream Processing Abstractions Window Use a sliding window to gather packet payload and call a function. Packetize Segment a byte array into a sequence of packets, Control Flow Group By Branch control flow between abstractions. Shuffle Shuffle packets across processing cores. Merge Merge control from branches. State Abstractions Bounded Consistency State State store with tunable consistency specification. Schedulabe Abstractions Invoke Periodically execute a function.

slide-67
SLIDE 67

Shuffle Abstraction

Input

Core 1 Core 2 Core 3 Core 4

Output Demux Counter

Counters

+ + + + Mux Spread packets across cores for scaling

slide-68
SLIDE 68

Shuffle Abstraction

Input

Core 1 Core 2 Core 3 Core 4

Output Demux Counter

Counters

+ + + + Mux Spread packets across cores for scaling Might even use hardware for this.

slide-69
SLIDE 69

Example NF: Maglev

  • Maglev: Load balancer from Google (NSDI’16).
  • Main contribution: a novel consistent hashing algorithm.
  • Most of the work in common optimization: batching, scaling cross core.
  • NetBricks implementation: 105 lines, 2 hours of grad student time.
  • Comparable performance to optimized code
slide-70
SLIDE 70

Managing NFs Building and Running NFs

slide-71
SLIDE 71

E2 (SOSP’15) Stratos FTMB (SIGCOMM ’15) FlowTags (NSDI ’14) Managing NFs Building and Running NFs

slide-72
SLIDE 72

E2 (SOSP’15) Stratos FTMB (SIGCOMM ’15) FlowTags (NSDI ’14) Managing NFs Building and Running NFs xOMB (ANCS’12) CoMB (NSDI’12) No Isolation

slide-73
SLIDE 73

E2 (SOSP’15) Stratos FTMB (SIGCOMM ’15) FlowTags (NSDI ’14) Managing NFs Building and Running NFs xOMB (ANCS’12) CoMB (NSDI’12) No Isolation NetVM (IEEE TNSM) ClickOS (NSDI’14) HyperSwitch (ATC’13) mSwitch (SOSR’15) VM Isolation

slide-74
SLIDE 74

E2 (SOSP’15) Stratos FTMB (SIGCOMM ’15) FlowTags (NSDI ’14) Managing NFs Building and Running NFs xOMB (ANCS’12) CoMB (NSDI’12) No Isolation NetVM (IEEE TNSM) ClickOS (NSDI’14) HyperSwitch (ATC’13) mSwitch (SOSR’15) VM Isolation No Packet Isol.

slide-75
SLIDE 75
  • Performance demands for NFV require forwarding 10-100 MPPS.
  • Requires isolation for consolidation.
  • Software isolation is necessary to meet performance requirements.
  • Requires low level optimization, slowing down NF development.
  • Abstract operators + UDF can simplify development without sacrificing performance.

Conclusion

slide-76
SLIDE 76
  • Performance demands for NFV require forwarding 10-100 MPPS.
  • Requires isolation for consolidation.
  • Software isolation is necessary to meet performance requirements.
  • Requires low level optimization, slowing down NF development.
  • Abstract operators + UDF can simplify development without sacrificing performance.

Conclusion

Code available at http://netbricks.io/

slide-77
SLIDE 77

Backup

slide-78
SLIDE 78

Both Memory Isolation and I/O Induce Overheads