Janus: Intra-Process Isolation for High-Throughput Data Plane Libraries

As network, I/O, accelerator, and NVM devices capable of a million operations per second make their way into data centers, the software stack managing such devices has been shifting from implementations within the operating system kernel to more specialized kernel-bypass approaches. While the in-kernel approach guarantees both safety and fairness, it imposes too much overhead on microsecond-scale tasks. Kernel-bypass approaches improve throughput substantially but sacrifice safety and complicate resource management: if applications are mutually untrusting, then either each application must have exclusive access to its own device or else the device itself must implement resource management. This paper shows how to attain both safety and performance via intra-process isolation for multiple data plane libraries. Our protected libraries provide separate user-level protection domains for different services (e.g., network and in-memory database), with performance approaching that of unprotected kernel bypass. We explore two concrete implementations of protected libraries. The first uses Intel's VM functions (VMFUNC) mechanism to switch between pre-established address spaces without entering the kernel. The second uses the mechanism of memory protection keys (Intel's PKU) to change the permissions associated with subsets of a single address space. We show that these approaches can efficiently protect high-throughput in-memory databases and user-space network stacks. The PKU approach incurs less than 10% protection cost at up to 2.3 million library switches per second per core. The VMFUNC approach is more expensive, but, it eliminates the need to inspect program binaries and offers stronger protection against speculative side-channel data leaks. Both approaches significantly outperform kernel-level protection or system call switching of user-level address spaces