Chad parenthetically wrote on VMDirectPath in a recent blog:

Normally, as people who know me can attest to, I’m not a general fan of VMdirectpath. Most people think of it as a “performance thing” when the reality is that with VMXNET3 and pvSCSI adapters in vSphere 4 you can get to within low percentage points of the same performance as you can with “hypervisor bypass” (met 3 customers in the last 2 weeks who were adamant they needed VMDirectPath for “performance” – but didn’t know what their perf goals were, and were using VI3 as the baseline – argh), and I know that this is called out in Cisco’s training on UCS. For some reason people think for “high performance IO” you can’t do it without bypass, but that is not explicitly true.

I have been touring the world telling people that VMDirectPath is not a performance feature ever since it was released.  Unfortunately my pithy marketing statements are only partial truth.  In March of this year VMware released an update to their ongoing SPECweb work that leveraged VMDirectPath.  It is unfortunate that this article encourages customers to implement VMDirectPath.  I want to convince you to ignore it.

Before it was released, VMware was internally calling VMDirectPath “pass through”.  The idea was to provide direct access to the underlying hardware to the guest operating system and its applications.  The monumental negative impact of this is that the guest operating system becomes married to the physical hardware.  This means the virtual machine cannot be moved (vMotion), load balanced (DRS), protected through fault tolerance (FT), and many other awesome vSphere feature.  Enabling VMDirectPath for a virtual machine effectively moves your virtualization technology back to 2006.

The only reason why anyone is considering VMDirectPath for production deployments is the possibility of increased performance.  But the only workload for which VMware has ever claimed substantial gains from this feature is the SPECweb work I quoted above.  That workload sustained 30 Gb/s of network traffic.  I doubt any of VMware’s customers are using even a fraction of this network throughput on a single server in their production environments.

Even in this extremely intense network environment, the VMDirectPath contribution to application throughput is not quantified.  I discussed its impact with the engineer that performed the test and he estimated the performance improvement at less than 10%.

The reason why device passthrough is not useful in vSphere is because of the incredible efficiency gains VMware has made with vmxnet and its virtual storage stack.  As Chad mentioned above, customers carry with them bad memories of VMware’s IO capabilities in VI3.  That was a different era, my friends.  I hope that I can convince you to trust VMware’s core technologies and not be looking for features that circumvent them.

So, let me summarize:

• If you enable VMDirectPath you lose most of the features you love about vSphere.
• VMDirectPath has never been shown to have any impact on tier-1 applications even with high network needs (10 Gb/s).
• The largest possible performance gain VMDirectPath has been shown to add to an application is about 10%, and that was an extreme network usage of 30 Gb/s.

Tread carefully with this feature, everyone.  Its usage should be a last resort, not a first.

I think this rumor sprung from our somewhat limited support of paravirtualized drivers in FT-protected virtual machines, which will be improved in a subsequent release.  And while most of you probably know that PVSCSI and vmxnet3 run together, I thought it worth a brief comment on this blog.  Myths are like cockroaches.  For every one you see there are hundreds hiding behind the walls.

What follows is my tale of performance optimizations so arcane and of extremely limited relevance as to make this guidance useful to one customer in 100,000.  The parameters I reference here should rarely–if ever–be touched by a VI admin.  I am documenting them for here for that one mischievous soul that is allowed to do as much damage as good in the pursuit of performance excellence. The rest of you should not even consider these changes for your production environment.

Seriously.  Don’t do it.  Don’t do it.

About two weeks ago I got a call that a large customer was in need of an immediate performance assistance.  Ten hours after that I was on a plane to Boston.  Nine hours later I was sitting in the customer’s lab looking at the problem.  Five hours later the problem was fixed.  Three hours more and I was reporting out to the customer’s management.  Two hours after that I was at Fenway with a beer in one hand and chowder in the other.  What follows is a very brief synopsis of the problem and its solutions.

The customer was using VMware on a very strange (non-HCL) server.  Their stringent requirements stated that one virtual machine, configured as a network bridge using RHEL 5.3′s bridge-utils, must drop zero 64-byte UDP packets at up to 80,000 frames per second.  The Ixia device the customer was using for network tests reported that the ESXi-based virtual machine was maxing out at at 20,000 FPS while meeting the 0% packet loss requirement.

I tried about a dozen configuration changes in my half-day of experimentation and learned a few interesting things.

Occasionally the e1000 Will Outperform vmxnet3

This was a surprise to me at first but our network team later explained it to me clearly.  The e1000 device will never make a monitor-to-kernel call and instead relies entirely on VMkernel polling to pass information from the guest to the host.  vmxnet does make VMM->VMk calls after queuing up packets to limit the overhead of packet processing.  This buffering behavior benefits network throughput in about 99% of cases but the additional VMM->VMk calls were not helpful with this rare workload.

The vmxnet Throughput/Latency Tradeoff Is Configurable

ESX and ESXi expose a large number of advanced network settings that can be used to configure vmxnet’s predilection for throughput or latency.  Increasing vmxnetThroughputWeight, for instance, tells vmxnet to buffer packets longer to reduce the number of VMM->VMk calls, thus improving efficiency.  CoalesceTxTimeout will similarly affect buffering by setting a maximum coalesce time for both vmxnet and e1000.

VMware has demonstrated on one workload a successful modification of the default for vmxnetThroughputWeight.  See our SPECweb work that peaked at 16 Gb/s throughput, for instance.  My customer could not benefit from this parameter as it only changes vmxnet behavior but we did see gains by increasing CoalesceTxTimeout.

Guest Drivers Require Optimization for Small Packets

The size of the ring queues used by device drivers for physical and virtual devices is configurable.  Those buffers default to 256 entries but can be increased to 4096 for both vmxnet and e1000 when using vSphere.  For very small packets that arrive incredibly rapidly a larger ring queue is needed to avoid unnecessary packet drops.  When I used ethtool to increase in ring queue size the packet drop rate decreased dramatically.

Summary

If you have a environment that consistently seeing large volumes of tiny UDP packets (less than 128 B) some of these changes may improve your environment. But this configuration is uncommon enough in the virtualized enterprise that you probably do not have such a workload. So, do not start playing with vSphere’s defaults unless you know you are running an application that is a clear outlier.