1 Background and Motivation

At the Xen hackaton ’16 networking session, we spoke about having a permanently mapped region to describe header/linear region of packet buffers. This document outlines the proposal covering motivation of this and applicability for other use-cases alongside the necessary changes.

The motivation of this work is to eliminate grant ops for packet I/O intensive workloads such as those observed with smaller requests size (i.e. <= 256 bytes or <= MTU). Currently on Xen, only bulk transfer (e.g. 32K..64K packets) are the only ones performing really good (up to 80 Gbit/s in few CPUs), usually backing end-hosts and server appliances. Anything that involves higher packet rates (<= 1500 MTU) or without sg, performs badly almost like a 1 Gbit/s throughput.

2 Proposal

The proposal is to leverage the already implicit copy from and to packet linear data on netfront and netback, to be done instead from a permanently mapped region. In some (physical) NICs this is known as header/data split.

Specifically some workloads (e.g. NFV) it would provide a big increase in throughput when we switch to (zero)copying in the backend/frontend, instead of the grant hypercalls. Thus this extension aims at futureproofing the netif protocol by adding the possibility of guests setting up a list of grants that are set up at device creation and revoked at device freeing - without taking too much grant entries in account for the general case (i.e. to cover only the header region <= 256 bytes, 16 grants per ring) while configurable by kernel when one wants to resort to a copy-based as opposed to grant copy/map.

3 General Operation

Here we describe how netback and netfront general operate, and where the proposed solution will fit. The security mechanism currently involves grants references which in essence are round-robin recycled ‘tickets’ stamped with the GPFNs, permission attributes, and the authorized domain:

(This is an in-memory view of struct grant_entry_v1):

 0     1     2     3     4     5     6     7 octet
+------------+-----------+------------------------+
| flags      | domain id | frame                  |
+------------+-----------+------------------------+

Where there are N grant entries in a grant table, for example:

@0:
+------------+-----------+------------------------+
| rw         | 0         | 0xABCDEF               |
+------------+-----------+------------------------+
| rw         | 0         | 0xFA124                |
+------------+-----------+------------------------+
| ro         | 1         | 0xBEEF                 |
+------------+-----------+------------------------+

  .....
@N:
+------------+-----------+------------------------+
| rw         | 0         | 0x9923A                |
+------------+-----------+------------------------+

Each entry consumes 8 bytes, therefore 512 entries can fit on one page. The gnttab_max_frames which is a default of 32 pages. Hence 16,384 grants. The ParaVirtualized (PV) drivers will use the grant reference (index in the grant table - 0 .. N) in their command ring.

3.1 Guest Transmit

The view of the shared transmit ring is the following:

 0     1     2     3     4     5     6     7 octet
+------------------------+------------------------+
| req_prod               | req_event              |
+------------------------+------------------------+
| rsp_prod               | rsp_event              |
+------------------------+------------------------+
| pvt                    | pad[44]                |
+------------------------+                        |
| ....                                            | [64bytes]
+------------------------+------------------------+-\
| gref                   | offset    | flags      | |
+------------+-----------+------------------------+ +-'struct
| id         | size      | id        | status     | | netif_tx_sring_entry'
+-------------------------------------------------+-/
|/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/| .. N
+-------------------------------------------------+

Each entry consumes 16 octets therefore 256 entries can fit on one page.struct netif_tx_sring_entry includes both struct netif_tx_request (first 12 octets) and struct netif_tx_response (last 4 octets). Additionally a struct netif_extra_info may overlay the request in which case the format is:

+------------------------+------------------------+-\
| type |flags| type specific data (gso, hash, etc)| |
+------------+-----------+------------------------+ +-'struct
| padding for tx         | unused                 | | netif_extra_info'
+-------------------------------------------------+-/

In essence the transmission of a packet in a from frontend to the backend network stack goes as following:

Frontend

1. Calculate how many slots are needed for transmitting the packet. Fail if there are aren’t enough slots.

[ Calculation needs to estimate slots taking into account 4k page boundary ]

2. Make first request for the packet. The first request contains the whole packet size, checksum info, flag whether it contains extra metadata, and if following slots contain more data.

3. Put grant in the gref field of the tx slot.

4. Set extra info if packet requires special metadata (e.g. GSO size)

5. If there’s still data to be granted set flag NETTXF_more_data in request flags.

6. Grant remaining packet pages one per slot. (grant boundary is 4k)

7. Fill resultant grefs in the slots setting NETTXF_more_data for the N-1.

8. Fill the total packet size in the first request.

9. Set checksum info of the packet (if the chksum offload if supported)

10. Update the request producer index (req_prod)

11. Check whether backend needs a notification

11.1) Perform hypercall EVTCHNOP_send which might mean a VMEXIT depending on the guest type.

Backend

12. Backend gets an interrupt and runs its interrupt service routine.

13. Backend checks if there are unconsumed requests

14. Backend consume a request from the ring

15. Process extra info (e.g. if GSO info was set)

16. Counts all requests for this packet to be processed (while NETTXF_more_data is set) and performs a few validation tests:

16.1) Fail transmission if total packet size is smaller than Ethernet minimum allowed;

Failing transmission means filling id of the request and status of NETIF_RSP_ERR of struct netif_tx_response; update rsp_prod and finally notify frontend (through EVTCHNOP_send).

16.2) Fail transmission if one of the slots (size + offset) crosses the page boundary

16.3) Fail transmission if number of slots are bigger than spec defined (18 slots max in netif.h)

17. Allocate packet metadata

[ Linux specific: This structure emcompasses a linear data region which generally accomodates the protocol header and such. Netback allocates up to 128 bytes for that. ]

18. Linux specific: Setup up a GNTTABOP_copy to copy up to 128 bytes to this small region (linear part of the skb) only from the first slot.

19. Setup GNTTABOP operations to copy/map the packet

20. Perform the GNTTABOP_copy (grant copy) and/or GNTTABOP_map_grant_ref hypercalls.

[ Linux-specific: does a copy for the linear region (<=128 bytes) and maps the remaining slots as frags for the rest of the data ]

21. Check if the grant operations were successful and fail transmission if any of the resultant operation status were different than GNTST_okay.

21.1) If it’s a grant copying backend, therefore produce responses for all the the copied grants like in 16.1). Only difference is that status is NETIF_RSP_OKAY.

21.2) Update the response producer index (rsp_prod)

22. Set up gso info requested by frontend [optional]

23. Set frontend provided checksum info

24. Linux-specific: Register destructor callback when packet pages are freed.

25. Call into to the network stack.

26. Update req_event to request consumer index + 1 to receive a notification on the first produced request from frontend. [optional, if backend is polling the ring and never sleeps]

27. Linux-specific: Packet destructor callback is called.

27.1) Set up GNTTABOP_unmap_grant_ref ops for the designated packet pages.

27.2) Once done, perform GNTTABOP_unmap_grant_ref hypercall. Underlying this hypercall a TLB flush of all backend vCPUS is done.

27.3) Produce Tx response like step 21.1) and 21.2)

[Linux-specific: It contains a thread that is woken for this purpose. And it batch these unmap operations. The callback just queues another unmap.]

27.4) Check whether frontend requested a notification

27.4.1) If so, Perform hypercall EVTCHNOP_send which might mean a VMEXIT depending on the guest type.

Frontend

28. Transmit interrupt is raised which signals the packet transmission completion.

29. Transmit completion routine checks for unconsumed responses

30. Processes the responses and revokes the grants provided.

31. Updates rsp_cons (request consumer index)

This proposal aims at removing steps 19) 20) 21) by using grefs previously mapped at guest request. Guest decides how to distribute or use these premapped grefs with either linear or full packet. This allows us to replace step 27) (the unmap) preventing the TLB flush.

Note that a grant copy does the following (in pseudo code):

rcu_lock(src_domain);
rcu_lock(dst_domain);

for (op = gntcopy[0]; op < nr_ops; op++) {
    src_frame = __acquire_grant_for_copy(src_domain, <op.src.gref>);
    ^ here implies a holding a potential contended per CPU lock on the
          remote grant table.
    src_vaddr = map_domain_page(src_frame);

    dst_frame = __get_paged_frame(dst_domain, <op.dst.mfn>)
    dst_vaddr = map_domain_page(dst_frame);

    memcpy(dst_vaddr + <op.dst.offset>,
        src_frame + <op.src.offset>,
        <op.size>);

    unmap_domain_page(src_frame);
    unmap_domain_page(dst_frame);

rcu_unlock(src_domain);
rcu_unlock(dst_domain);

Linux netback implementation copies the first 128 bytes into its network buffer linear region. Hence on the case of the first region it is replaced by a memcpy on backend, as opposed to a grant copy.

3.2 Guest Receive

The view of the shared receive ring is the following:

 0     1     2     3     4     5     6     7 octet
+------------------------+------------------------+
| req_prod               | req_event              |
+------------------------+------------------------+
| rsp_prod               | rsp_event              |
+------------------------+------------------------+
| pvt                    | pad[44]                |
+------------------------+                        |
| ....                                            | [64bytes]
+------------------------+------------------------+
| id         | pad       | gref                   | ->'struct netif_rx_request'
+------------+-----------+------------------------+
| id         | offset    | flags     | status     | ->'struct netif_rx_response'
+-------------------------------------------------+
|/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/| .. N
+-------------------------------------------------+

Each entry in the ring occupies 16 octets which means a page fits 256 entries. Additionally a struct netif_extra_info may overlay the rx request in which case the format is:

+------------------------+------------------------+
| type |flags| type specific data (gso, hash, etc)| ->'struct netif_extra_info'
+------------+-----------+------------------------+

Notice the lack of padding, and that is because it’s not used on Rx, as Rx request boundary is 8 octets.

In essence the steps for receiving of a packet in a Linux frontend is as from backend to frontend network stack:

Backend

1. Backend transmit function starts

[Linux-specific: It means we take a packet and add to an internal queue (protected by a lock) whereas a separate thread takes it from that queue and process the actual like the steps below. This thread has the purpose of aggregating as much copies as possible.]

2. Checks if there are enough rx ring slots that can accomodate the packet.

3. Gets a request from the ring for the first data slot and fetches the gref from it.

4. Create grant copy op from packet page to gref.

[ It’s up to the backend to choose how it fills this data. E.g. backend may choose to merge as much as data from different pages into this single gref, similar to mergeable rx buffers in vhost. ]

5. Sets up flags/checksum info on first request.

6. Gets a response from the ring for this data slot.

7. Prefill expected response ring with the request id and slot size.

8. Update the request consumer index (req_cons)

9. Gets a request from the ring for the first extra info [optional]

10. Sets up extra info (e.g. GSO descriptor) [optional] repeat step 8).

11. Repeat steps 3 through 8 for all packet pages and set NETRXF_more_data in the N-1 slot.

12. Perform the GNTTABOP_copy hypercall.

13. Check if the grant operations status was incorrect and if so set status of the struct netif_rx_response field to NETIF_RSP_ERR.

14. Update the response producer index (rsp_prod)

Frontend

15. Frontend gets an interrupt and runs its interrupt service routine

16. Checks if there’s unconsumed responses

17. Consumes a response from the ring (first response for a packet)

18. Revoke the gref in the response

19. Consumes extra info response [optional]

20. While N-1 requests has NETRXF_more_data, then fetch each of responses and revoke the designated gref.

21. Update the response consumer index (rsp_cons)

22. Linux-specific: Copy (from first slot gref) up to 256 bytes to the linear region of the packet metadata structure (skb). The rest of the pages processed in the responses are then added as frags.

23. Set checksum info based on first response flags.

24. Call packet into the network stack.

25. Allocate new pages and any necessary packet metadata strutures to new requests. These requests will then be used in step 1) and so forth.

26. Update the request producer index (req_prod)

27. Check whether backend needs notification:

27.1) If so, Perform hypercall EVTCHNOP_send which might mean a VMEXIT depending on the guest type.

28. Update rsp_event to response consumer index + 1 such that frontend receive a notification on the first newly produced response. [optional, if frontend is polling the ring and never sleeps]

This proposal aims at replacing step 4), 12) and 22) with memcpy if the grefs on the Rx ring were requested to be mapped by the guest. Frontend may use strategies to allow fast recycling of grants for replinishing the ring, hence letting Domain-0 replace the grant copies with memcpy instead, which is faster.

Depending on the implementation, it would mean that we no longer would need to aggregate as much as grant ops as possible (step 1) and could transmit the packet on the transmit function (e.g. Linux ndo_start_xmit) as previously proposed here[0]. This would heavily improve efficiency specifially for smaller packets. Which in return would decrease RTT, having data being acknoledged much quicker.

4 Proposed Extension

The idea is to allow guest more controllability on how its grants are mapped or not. Currently there’s no control over it for frontends or backends, and latter cannot make assumptions on the mapping transmit or receive grants, hence we need frontend to take initiative into managing its own mapping of grants. Guests may then opportunistically recycle these grants (e.g. Linux) and avoid resorting to copies which come when using a fixed amount of buffers. Other frameworks (e.g. XDP, netmap, DPDK) use a fixed set of buffers which also makes the case for this extension.

4.1 Terminology

staging grants is a term used in this document to refer to the whole concept of having a set of grants permanently mapped with backend, containing data staging until completion. Therefore the term should not be confused with a new kind of grants on the hypervisor.

4.2 Control Ring Messages

4.2.1 XEN_NETIF_CTRL_TYPE_GET_GREF_MAPPING_SIZE

This message is sent by the frontend to fetch the number of grefs that can be kept mapped in the backend. It only receives the queue as argument, and data representing amount of free entries in the mapping table.

4.2.2 XEN_NETIF_CTRL_TYPE_ADD_GREF_MAPPING

This is sent by the frontend to map a list of grant references in the backend. It receives the queue index, the grant containing the list (offset is implicitly zero) and how many entries in the list. Each entry in this list has the following format:

    0     1     2     3     4     5     6     7  octet
 +-----+-----+-----+-----+-----+-----+-----+-----+
 | grant ref             |  flags    |  status   |
 +-----+-----+-----+-----+-----+-----+-----+-----+

 grant ref: grant reference
 flags: flags describing the control operation
 status: XEN_NETIF_CTRL_STATUS_*

The list can have a maximum of 512 entries to be mapped at once. The ‘status’ field is not used for adding new mappings and hence, The message returns an error code describing if the operation was successful or not. On failure cases, none of the grant mappings specified get added.

4.2.3 XEN_NETIF_CTRL_TYPE_DEL_GREF_MAPPING

This is sent by the frontend for backend to unmap a list of grant references. The arguments are the same as XEN_NETIF_CTRL_TYPE_ADD_GREF_MAPPING, including the format of the list. The entries used are only the ones representing grant references that were previously the subject of a XEN_NETIF_CTRL_TYPE_ADD_GREF_MAPPING operation. Any other entries will have their status set to XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER upon completion. The entry ‘status’ field determines if the entry was successfully removed.

4.3 Datapath Changes

Control ring is only available after backend state is XenbusConnected therefore only on this state change can the frontend query the total amount of maps it can keep. It then grants N entries per queue on both TX and RX ring which will create the underying backend gref -> page association (e.g. stored in hash table). Frontend may wish to recycle these pregranted buffers or choose a copy approach to replace granting.

On steps 19) of Guest Transmit and 3) of Guest Receive, data gref is first looked up in this table and uses the underlying page if it already exists a mapping. On the successfull cases, steps 20) 21) and 27) of Guest Transmit are skipped, with 19) being replaced with a memcpy of up to 128 bytes. On Guest Receive, 4) 12) and 22) are replaced with memcpy instead of a grant copy.

Failing to obtain the total number of mappings (XEN_NETIF_CTRL_TYPE_GET_GREF_MAPPING_SIZE) means the guest falls back to the normal usage without pre granting buffers.

5 Wire Performance

This section is a glossary meant to keep in mind numbers on the wire.

The minimum size that can fit in a single packet with size N is calculated as:

Packet = Ethernet Header (14) + Protocol Data Unit (46 - 1500) = 60 bytes

In the wire it’s a bit more:

Preamble (7) + Start Frame Delimiter (1) + Packet + CRC (4) + Interframe gap (12) = 84 bytes

For given Link-speed in Bits/sec and Packet size, real packet rate is calculated as:

Rate = Link-speed / ((Preamble + Packet + CRC + Interframe gap) * 8)

Numbers to keep in mind (packet size excludes PHY layer, though packet rates disclosed by vendors take those into account, since it’s what goes on the wire):

Caption: Mpps (Million packets per second) ; Kpps (Kilo packets per second)

6 Performance

Numbers between a Linux v4.11 guest and another host connected by a 100 Gbit/s NIC on a E5-2630 v4 2.2 GHz host to give an idea on the performance benefits of this extension. Please refer to this presentation[7] for a better overview of the results.

( Numbers include protocol overhead )

bulk transfer (Guest TX/RX)

( Guest -> Dom0 )

Packet I/O (Guest TX/RX) in UDP 64b

7 References

[0] http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg01504.html

[1] https://github.com/freebsd/freebsd/blob/master/sys/dev/netmap/netmap_mem2.c#L362

[2] https://www.freebsd.org/cgi/man.cgi?query=vale&sektion=4&n=1

[3] https://github.com/iovisor/bpf-docs/blob/master/Express_Data_Path.pdf

[4] http://prototype-kernel.readthedocs.io/en/latest/networking/XDP/design/requirements.html#write-access-to-packet-data

[5] http://lxr.free-electrons.com/source/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c#L2073

[6] http://lxr.free-electrons.com/source/drivers/net/ethernet/mellanox/mlx4/en_rx.c#L52

[7] https://schd.ws/hosted_files/xendeveloperanddesignsummit2017/e6/ToGrantOrNotToGrant-XDDS2017_v3.pdf

8 History

A table of changes to the document, in chronological order.