Memory and Performance Isolation for a Multi tenant Function based Dataplane
Existing software dataplanes that run network functions inside VMs or containers can provide either performance (by dedicating CPU cores) or multiplexing (by context switching) but not both at once. Function based dataplane architectures that avoid context switching by replacing VMs and containers with function calls to packet processing functions promise to achieve both multiplexing and performance at the same time. However, they compromise memory isolation between tenants by forcing them to use a shared memory address space. In this paper, we show that an operating system like management layer for modules in a function based data plane can offer OS like constructs such as performance and memory isolation. We are applying these insights in developing FastPaas, a function based data plane for multi tenant environments. To provide memory isolation, FastPaas leverages new Intel CPU extensions (MPX) to create coarse grained heap and stack protection even for legacy code written in unsafe native languages such as C. In addition, FastPaas uses programmable NIC offloads to distribute load across cores as well as to prevent batch fragmentation when processing complex service graphs. Our preliminary evaluation shows the limitations of existing techniques that require heavy weight memory isolation or incur cross core overheads.