Setting and using speed limit for Open vSwitch with DPDK
This article describes how to configure the inbound speed limit for the Data Plane Development Kit (DPDK) interface in Open vSwitch (OVS) with DPDK. This article is intended for network administrators who can use the Open vSwitch speed limit to provide guaranteed reception speed for DPDK ports on deployed Open vSwitch servers. This article complements the article Configuring and Using Quality of Service for Open vSwitch * with DPDK , since speed limits and quality of service operate respectively on the receive and transmit paths, using unique API commands for configuration and operation.
Note. At the time of this writing, the OVS speed limit with DPDK was available only in the main OVS branch . Download the ZIP archive of the main branch of OVS here . The steps to install OVS with DPDK are described here .
Before setting the speed limit, you should tell about the differences from the quality of service and about the interaction with traffic in vSwitch.
')
Quality of service applies to outgoing traffic, that is, data transmitted from the OVS port. The speed limit, by contrast, is valid only for incoming traffic, that is, for data received by the vSwitch port. The speed limit is implemented in OVS with DPDK using an incoming traffic limiter (similar to the outbound traffic limiter for quality of service supported in OVS with DPDK). The incoming traffic limiter starts to simply drop packets after exceeding a certain reception rate in the interface (token buffer algorithm). For a physical device, the incoming traffic limiter will drop traffic coming from outside the system through the network adapter. For the virtual interface, that is, the vhost-user DPDK port, the delimiter will drop traffic transmitted from the guest machine to the vSwitch. In fact, the speed of data transmission from the guest machine to this port is limited. This is shown in fig. one.
Fig. 1. Speed Limit using Inbound Traffic Limit for vhost-user port
Fig. 2. Test environment
Note. Both the host computer and the virtual machines (VMs) used in this environment are running the 64-bit version of Fedora * 23 Server with the Linux * 4.4.6 kernel. Each VM has a virtual network adapter connected to the vSwitch bridge through the vhost-user DPDK interface. A virtual network adapter is displayed as a Linux kernel device (for example, ens0) in the virtual machine operating system. Make sure there is a connection between the virtual machines (for example, send a ping to VM2 from VM1).
To test the setup, install iPerf * on both VMs . Make sure that the rpm version matches the guest OS version. In this case, you should use the 6564-bit version of Fedora. If you use Package Manager in Fedora 23, for example, dnf in Fedora 23, you can automatically install iPerf with the following command:
To verify the configuration, make sure iPerf is installed on both virtual machines. iPerf can be run in client mode and server mode. In this example, we will launch the iPerf client on VM1 and the iPerf server on VM2.
On VM2, run the following command to deploy the iPerf server in UDP mode on port 8080:
On VM1, run the following command to deploy the iPerf client in UDP mode on port 8080 with a data transfer rate of 100 Mbps:
In this case, VM1 will attempt to transfer data to VM2 using UDP protocol with a speed of 100 Mbps. After 10 seconds, a set of values will appear. Run these commands before setting the speed limit. You will see results similar to those shown in fig. 3. In the server report, we are interested in the Bandwidth column.
Fig. 3. Output without limiting incoming traffic
The data shown in Fig. 3 indicate that the connection bandwidth between virtual machines is 100 Mbps.
Now configure the speed limit using the vhost-user1 inbound traffic limiter to 10 Mbps using the following command:
Parameters are described below.
If you run UDP iPerf throughput test again, the results will be similar to those shown in fig. four.
Fig. 4. Output with restricted inbound traffic
Note that now, with a configured traffic limiter, the available bandwidth is 9.59 Mbps, not 100 Mbps. The iPerf program sent UDP traffic from the VM1 client to the VM2 server at 100 Mbps, but the traffic speed was reduced, since the incoming traffic limiter operates on the incoming vhost-user1 vSwitch port path. Due to this, the speed of traffic transmitted from the iPerf VM1 client was reduced to approximately 10 Mbps.
Note that if TCP traffic is used, then the value of the ingress_policing_burst parameter should be a significant proportion of the value of the ingress_policing_rate parameter; It is recommended that it exceed 10%. This is due to the performance degradation of the TCP protocol when packet drops and problems with packet retransmission occur.
The existing speed limit setting for vhost-user1 can be obtained using the following command:
To cancel the vhost-user1 traffic speed limit, set the ingress_policing_rate parameter to 0, as shown below (you do not need to configure the ingress_policing_burst parameter value):
In this article, we showed a simple example in which traffic is transferred between two virtual machines via an Open vSwitch * with DPDK with a configured inbound traffic limiter. We demonstrated commands for setting the speed limit for a given DPDK port, for getting information about the current speed limit setting, and for canceling the speed limit.
For more information about using speed limits, parameters, and more, see the speed limit sections in vswitch.xml and ovs-vswitchd.conf.db .
Have a question? Requests for Open vSwitch can be sent to the mail discussion .
For more information about Open vSwitch * with DPDK, see the following videos and articles on the Intel Developer Zone and Intel Network Builders University.
Translated articles on Habrahabr
Note. At the time of this writing, the OVS speed limit with DPDK was available only in the main OVS branch . Download the ZIP archive of the main branch of OVS here . The steps to install OVS with DPDK are described here .
Speed limit in OVS with DPDK
Before setting the speed limit, you should tell about the differences from the quality of service and about the interaction with traffic in vSwitch.
')
Quality of service applies to outgoing traffic, that is, data transmitted from the OVS port. The speed limit, by contrast, is valid only for incoming traffic, that is, for data received by the vSwitch port. The speed limit is implemented in OVS with DPDK using an incoming traffic limiter (similar to the outbound traffic limiter for quality of service supported in OVS with DPDK). The incoming traffic limiter starts to simply drop packets after exceeding a certain reception rate in the interface (token buffer algorithm). For a physical device, the incoming traffic limiter will drop traffic coming from outside the system through the network adapter. For the virtual interface, that is, the vhost-user DPDK port, the delimiter will drop traffic transmitted from the guest machine to the vSwitch. In fact, the speed of data transmission from the guest machine to this port is limited. This is shown in fig. one.
Fig. 1. Speed Limit using Inbound Traffic Limit for vhost-user port
Test environment
Fig. 2. Test environment
Note. Both the host computer and the virtual machines (VMs) used in this environment are running the 64-bit version of Fedora * 23 Server with the Linux * 4.4.6 kernel. Each VM has a virtual network adapter connected to the vSwitch bridge through the vhost-user DPDK interface. A virtual network adapter is displayed as a Linux kernel device (for example, ens0) in the virtual machine operating system. Make sure there is a connection between the virtual machines (for example, send a ping to VM2 from VM1).
Configure and test speed limits
To test the setup, install iPerf * on both VMs . Make sure that the rpm version matches the guest OS version. In this case, you should use the 6564-bit version of Fedora. If you use Package Manager in Fedora 23, for example, dnf in Fedora 23, you can automatically install iPerf with the following command:
dnf install iperf To verify the configuration, make sure iPerf is installed on both virtual machines. iPerf can be run in client mode and server mode. In this example, we will launch the iPerf client on VM1 and the iPerf server on VM2.
Test without incoming traffic limiter
On VM2, run the following command to deploy the iPerf server in UDP mode on port 8080:
iperf –s –u –p 8080 On VM1, run the following command to deploy the iPerf client in UDP mode on port 8080 with a data transfer rate of 100 Mbps:
iperf -c 7.7.7.2 -u -p 8080 -b 100m In this case, VM1 will attempt to transfer data to VM2 using UDP protocol with a speed of 100 Mbps. After 10 seconds, a set of values will appear. Run these commands before setting the speed limit. You will see results similar to those shown in fig. 3. In the server report, we are interested in the Bandwidth column.
Fig. 3. Output without limiting incoming traffic
The data shown in Fig. 3 indicate that the connection bandwidth between virtual machines is 100 Mbps.
Test with configured incoming traffic limiter
Now configure the speed limit using the vhost-user1 inbound traffic limiter to 10 Mbps using the following command:
ovs-vsctl set interface vhost-user1 ingress_policing_rate=10000 ingress_policing_burst=1000 Parameters are described below.
- ingress_policing_rate : The maximum speed (Kbps) allowed for this virtual machine. This value is required to create an inbound traffic limiter. If not specified, the existing speed limit setting will remain unchanged.
- ingress_policing_burst : size of the marker buffer in kilobytes. The minimum value of this parameter should be equal to the largest estimated packet size. If no value is specified, the default value of 8000 KB is used.
If you run UDP iPerf throughput test again, the results will be similar to those shown in fig. four.
Fig. 4. Output with restricted inbound traffic
Note that now, with a configured traffic limiter, the available bandwidth is 9.59 Mbps, not 100 Mbps. The iPerf program sent UDP traffic from the VM1 client to the VM2 server at 100 Mbps, but the traffic speed was reduced, since the incoming traffic limiter operates on the incoming vhost-user1 vSwitch port path. Due to this, the speed of traffic transmitted from the iPerf VM1 client was reduced to approximately 10 Mbps.
Note that if TCP traffic is used, then the value of the ingress_policing_burst parameter should be a significant proportion of the value of the ingress_policing_rate parameter; It is recommended that it exceed 10%. This is due to the performance degradation of the TCP protocol when packet drops and problems with packet retransmission occur.
The existing speed limit setting for vhost-user1 can be obtained using the following command:
ovs-vsctl list interface vhost-user1 To cancel the vhost-user1 traffic speed limit, set the ingress_policing_rate parameter to 0, as shown below (you do not need to configure the ingress_policing_burst parameter value):
ovs-vsctl set interface vhost-user1 ingress_policing_rate=0 Conclusion
In this article, we showed a simple example in which traffic is transferred between two virtual machines via an Open vSwitch * with DPDK with a configured inbound traffic limiter. We demonstrated commands for setting the speed limit for a given DPDK port, for getting information about the current speed limit setting, and for canceling the speed limit.
additional information
For more information about using speed limits, parameters, and more, see the speed limit sections in vswitch.xml and ovs-vswitchd.conf.db .
Have a question? Requests for Open vSwitch can be sent to the mail discussion .
For more information about Open vSwitch * with DPDK, see the following videos and articles on the Intel Developer Zone and Intel Network Builders University.
- Configure and use Quality of Service for Open vSwitch * with DPDK
- Open vSwitch * with DPDK: detailed architecture description
- DPDK Open vSwitch *: speed up connection to the guest system
Translated articles on Habrahabr
Source: https://habr.com/ru/post/309836/
All Articles