TY - GEN
T1 - Isolation Mechanisms for High-Speed Packet-Processing Pipelines
AU - Wang, Tao
AU - Yang, Xiangrui
AU - Antichi, Gianni
AU - Sivaraman, Anirudh
AU - Panda, Aurojit
N1 - Publisher Copyright:
© 2022 by The USENIX Association. All Rights Reserved.
PY - 2022
Y1 - 2022
N2 - Data-plane programmability is now mainstream. As we find more use cases, deployments need to be able to run multiple packet-processing modules in a single device. These are likely to be developed by independent teams, either within the same organization or from multiple organizations. Therefore, we need isolation mechanisms to ensure that modules on the same device do not interfere with each other. This paper presents Menshen, an extension of the Reconfigurable Match Tables (RMT) pipeline that enforces isolation between different packet-processing modules. Menshen is comprised of a set of lightweight hardware primitives and an extension to the open source P4-16 reference compiler that act in conjunction to meet this goal. We have prototyped Menshen on two FPGA platforms (NetFPGA and Corundum). We show that our design provides isolation, and allows new modules to be loaded without impacting the ones already running. Finally, we demonstrate the feasibility of implementing Menshen on ASICs by using the FreePDK45nm technology library and the Synopsys DC synthesis software, showing that our design meets timing at a 1 GHz clock frequency and needs approximately 6% additional chip area. We have open sourced the code for Menshen's hardware and software at https://isolation.quest/.
AB - Data-plane programmability is now mainstream. As we find more use cases, deployments need to be able to run multiple packet-processing modules in a single device. These are likely to be developed by independent teams, either within the same organization or from multiple organizations. Therefore, we need isolation mechanisms to ensure that modules on the same device do not interfere with each other. This paper presents Menshen, an extension of the Reconfigurable Match Tables (RMT) pipeline that enforces isolation between different packet-processing modules. Menshen is comprised of a set of lightweight hardware primitives and an extension to the open source P4-16 reference compiler that act in conjunction to meet this goal. We have prototyped Menshen on two FPGA platforms (NetFPGA and Corundum). We show that our design provides isolation, and allows new modules to be loaded without impacting the ones already running. Finally, we demonstrate the feasibility of implementing Menshen on ASICs by using the FreePDK45nm technology library and the Synopsys DC synthesis software, showing that our design meets timing at a 1 GHz clock frequency and needs approximately 6% additional chip area. We have open sourced the code for Menshen's hardware and software at https://isolation.quest/.
UR - http://www.scopus.com/inward/record.url?scp=85138297951&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85138297951&partnerID=8YFLogxK
M3 - Conference contribution
AN - SCOPUS:85138297951
T3 - Proceedings of the 19th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2022
SP - 1289
EP - 1305
BT - Proceedings of the 19th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2022
PB - USENIX Association
T2 - 19th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2022
Y2 - 4 April 2022 through 6 April 2022
ER -