xapi-project / xen-api / 29325037793

79%

push

github

CP-313264: introduce faster migration datapath using kernel TLS (kTLS) instead of stunnel (#7154)

stunnel is an external process that provides secure TLS transport for
the xenguest VM-migrate stream. It's a separate process from xenguest,
and the dom0 kernel pipes the data between these processes, wasting cpu
and memory throughput. The result is a slower VM-migrate experience, and
consequently a slower host-evacuate experience for the user.

This change removes this inefficient data pipe between stunnel and
xenguest, with a new option to replace stunnel's TLS with kernel TLS
(kTLS). When this ktls option is enabled, the kernel transparently uses
TLS to securely transport the data produced by xenguest, without the
need to modify xenguest and without the need to use stunnel.

Measurements indicate significant improvements:
* host-evacuate time: ~1.50x faster (stunnel/kTLS), depending on the
load of the guests (higher load the better, as there is more guest data
pages being transmitted, see details in the design page
[migration-tls.md](https://github.com/xapi-project/xen-api/compare/master...mg12:xen-api:cp-313264-migration-ktls?expand=1#diff-<a class=hub.com/xapi-project/xen-api/commit/7eead193dafea33095d3e70b27d0d0ee495a5950">7eead193dd004e4b7561780b6aebf5ebd)).
* dom0 cpu usage: ~20% less (see details in the design page
[migration-tls.md](https://github.com/xapi-project/xen-api/compare/master...mg12:xen-api:cp-313264-migration-ktls?expand=1#diff-7eead193dafea33095d3e70b27d0d0ee495a5950d004e4b7561780b6aebf5ebd)).

Activation uses a new xenopsd.conf flag, so the existing stunnel
datapath remains the default.

Tested with:
* performance tests
* ring3 BVT

3667 of 4642 relevant lines covered (79.0%)

0.79 hits per line