mirror of
https://github.com/netbirdio/gvisor.git
synced 2026-05-22 17:12:49 -07:00
Anqi Shen
56f2530dad
This commit supports a third-party network stack as a plugin stack for gVisor. The overall plugin package structure is the following: - pkg/sentry/socket/plugin: Interfaces for initializing plugin network stack. It will be used in network setting up during sandbox creating. - pkg/sentry/socket/plugin/stack: Glue layer for plugin stack's socket and stack ops with sentry. It will also register plugin stack operations if imported. - pkg/sentry/socket/plugin/cgo: Interfaces defined in C for plugin network stack to support. To build target runsc-plugin-stack, which imports pkg/sentry/socket/plugin/stack package and enables CGO: bazel build --config=plugin-tldk runsc:runsc-plugin-stack (i.e. --config=plugin-tldk indicates that using TLDK as plugin stack) By using runsc-plugin-stack binary and setting "--network=plugin" in runtimeArgs, user can use third-party network stack instead of netstack embedded in gVisor to get better network performance. Redis benchmark with following setups: 1. KVM platform 2. 4 physical cores for target pod 3. target pod as redis server Runc: $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 115207.38 requests per second, p50=0.215 msec GET: 92336.11 requests per second, p50=0.279 msec $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 113895.21 requests per second, p50=0.247 msec GET: 96899.23 requests per second, p50=0.271 msec $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 126582.27 requests per second, p50=0.199 msec GET: 95969.28 requests per second, p50=0.271 msec Runsc with plugin stack: $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 123915.74 requests per second, p50=0.343 msec GET: 115473.45 requests per second, p50=0.335 msec $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 120918.98 requests per second, p50=0.351 msec GET: 117647.05 requests per second, p50=0.351 msec $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 119904.08 requests per second, p50=0.367 msec GET: 112739.57 requests per second, p50=0.375 msec Runsc with netstack: $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 59952.04 requests per second, p50=0.759 msec GET: 61162.08 requests per second, p50=0.631 msec $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 52219.32 requests per second, p50=0.719 msec GET: 58719.91 requests per second, p50=0.663 msec $redis-benchmark -h [target ip] -n 100000 -t get,set -q SET: 59952.04 requests per second, p50=0.751 msec GET: 60827.25 requests per second, p50=0.751 msec Updates https://github.com/google/gvisor/issues/9266 Co-developed-by: Tianyu Zhou <wentong.zty@antgroup.com> Signed-off-by: Anqi Shen <amy.saq@antgroup.com>
92 lines
2.4 KiB
Go
92 lines
2.4 KiB
Go
// Copyright 2023 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package stack
|
|
|
|
import (
|
|
"net"
|
|
"syscall"
|
|
|
|
"gvisor.dev/gvisor/pkg/abi/linux"
|
|
"gvisor.dev/gvisor/pkg/abi/linux/errno"
|
|
"gvisor.dev/gvisor/pkg/hostarch"
|
|
"gvisor.dev/gvisor/pkg/safemem"
|
|
"gvisor.dev/gvisor/pkg/sentry/inet"
|
|
"gvisor.dev/gvisor/pkg/sentry/socket"
|
|
"gvisor.dev/gvisor/pkg/sentry/socket/plugin/cgo"
|
|
"gvisor.dev/gvisor/pkg/syserr"
|
|
)
|
|
|
|
func int2err(from int64) *syserr.Error {
|
|
if from >= 0 {
|
|
return nil
|
|
}
|
|
|
|
if (-from) == errno.EAGAIN {
|
|
return syserr.ErrWouldBlock
|
|
}
|
|
|
|
return syserr.FromHost(syscall.Errno(-from))
|
|
}
|
|
|
|
func translateReturn(ret int64) (uint64, error) {
|
|
if ret < 0 {
|
|
return 0, int2err(ret).ToError()
|
|
} else if ret == 0 {
|
|
return 0, nil
|
|
} else {
|
|
return uint64(ret), nil
|
|
}
|
|
}
|
|
|
|
func copyAddrOut(ifr *linux.IFReq, ifaceAddr *inet.InterfaceAddr) {
|
|
hostarch.ByteOrder.PutUint16(ifr.Data[0:2], uint16(ifaceAddr.Family))
|
|
hostarch.ByteOrder.PutUint16(ifr.Data[2:4], 0) // port
|
|
if ifaceAddr.Family == linux.AF_INET {
|
|
copy(ifr.Data[4:8], net.IP(ifaceAddr.Addr).To4()[:4])
|
|
} else {
|
|
copy(ifr.Data[8:24], ifaceAddr.Addr[:16])
|
|
}
|
|
}
|
|
|
|
func iovecsFromBlockSeq(bs safemem.BlockSeq, rw *pluginStackRW) []syscall.Iovec {
|
|
var iovs []syscall.Iovec
|
|
if rw != nil {
|
|
// Reuse the old buffer and set length to zero.
|
|
iovs = rw.iovs[:0]
|
|
}
|
|
for ; !bs.IsEmpty(); bs = bs.Tail() {
|
|
b := bs.Head()
|
|
iovs = append(iovs, syscall.Iovec{
|
|
Base: &b.ToSlice()[0],
|
|
Len: uint64(b.Len()),
|
|
})
|
|
}
|
|
return iovs
|
|
}
|
|
|
|
func buildControlMessage(controlData []byte) *socket.ControlMessages {
|
|
controlMessages := socket.ControlMessages{}
|
|
if len(controlData) >= 28 {
|
|
timebytes := controlData[12:]
|
|
timeval := (*linux.Timeval)(cgo.GetPtr(timebytes))
|
|
m := socket.IPControlMessages{
|
|
HasTimestamp: true,
|
|
Timestamp: timeval.ToTime(),
|
|
}
|
|
controlMessages.IP = m
|
|
}
|
|
return &controlMessages
|
|
}
|