| Message ID | 20180125040328.22867-7-tiwei.bie@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Jan 25, 2018 at 12:03:28PM +0800, Tiwei Bie wrote: > This patch does some small extensions to vhost-user protocol to > support VFIO based accelerators, and makes it possible to get the > similar performance of VFIO based PCI passthru while keeping the > virtio device emulation in QEMU. > > Any virtio ring compatible devices potentially can be used as the > vhost data path accelerators. We can setup the accelerator based > on the informations (e.g. memory table, features, ring info, etc) > available on the vhost backend. And accelerator will be able to use > the virtio ring provided by the virtio driver in the VM directly. > So the virtio driver in the VM can exchange e.g. network packets > with the accelerator directly via the virtio ring. > > But for vhost-user, the critical issue in this case is that the > data path performance is relatively low and some host threads are > needed for the data path, because some necessary mechanisms are > missing to support: > > 1) guest driver notifies the device directly; > 2) device interrupts the guest directly; > > So this patch does some small extensions to vhost-user protocol > to make both of them possible. It leverages the same mechanisms > as the VFIO based PCI passthru. > > A new protocol feature bit is added to negotiate the accelerator > feature support. Two new slave message types are added to control > the notify region and queue interrupt passthru for each queue. > >From the view of vhost-user protocol design, it's very flexible. > The passthru can be enabled/disabled for each queue individually, > and it's possible to accelerate each queue by different devices. > > The key difference with PCI passthru is that, in this case only > the data path of the device (e.g. DMA ring, notify region and > queue interrupt) is pass-throughed to the VM, the device control > path (e.g. PCI configuration space and MMIO regions) is still > defined and emulated by QEMU. > > The benefits of keeping virtio device emulation in QEMU compared > with virtio device PCI passthru include (but not limit to): > > - consistent device interface for guest OS in the VM; > - max flexibility on the hardware (i.e. the accelerators) design; > - leveraging the existing virtio live-migration framework; > > The virtual IOMMU isn't supported by the accelerators for now. > Because vhost-user currently lacks of an efficient way to share > the IOMMU table in VM to vhost backend. That's why the software > implementation of virtual IOMMU support in vhost-user backend > can't support dynamic mapping well. What exactly is meant by that? vIOMMU seems to work for people, it's not that fast if you change mappings all the time, but e.g. dpdk within guest doesn't. > Once this problem is solved > in vhost-user, virtual IOMMU can be supported by accelerators > too, and the IOMMU feature bit checking in this patch can be > removed. Given it works with software backends right now, I suspect this will be up to you guys to address. > Signed-off-by: Tiwei Bie <tiwei.bie@intel.com> > --- > docs/interop/vhost-user.txt | 57 ++++++++++++ > hw/virtio/vhost-user.c | 201 +++++++++++++++++++++++++++++++++++++++++ > include/hw/virtio/vhost-user.h | 17 ++++ > 3 files changed, 275 insertions(+) > > diff --git a/docs/interop/vhost-user.txt b/docs/interop/vhost-user.txt > index 954771d0d8..15e917019a 100644 > --- a/docs/interop/vhost-user.txt > +++ b/docs/interop/vhost-user.txt > @@ -116,6 +116,15 @@ Depending on the request type, payload can be: > - 3: IOTLB invalidate > - 4: IOTLB access fail > > + * Vring area description > + ----------------------- > + | u64 | size | offset | > + ----------------------- > + > + u64: a 64-bit unsigned integer > + Size: a 64-bit size > + Offset: a 64-bit offset > + > In QEMU the vhost-user message is implemented with the following struct: > > typedef struct VhostUserMsg { > @@ -129,6 +138,7 @@ typedef struct VhostUserMsg { > VhostUserMemory memory; > VhostUserLog log; > struct vhost_iotlb_msg iotlb; > + VhostUserVringArea area; > }; > } QEMU_PACKED VhostUserMsg; > > @@ -317,6 +327,17 @@ The fd is provided via VHOST_USER_SET_SLAVE_REQ_FD ancillary data. > A slave may then send VHOST_USER_SLAVE_* messages to the master > using this fd communication channel. > > +VFIO based accelerators > +----------------------- > + > +The VFIO based accelerators feature is a protocol extension. It is supported > +when the protocol feature VHOST_USER_PROTOCOL_F_VFIO (bit 7) is set. > + > +The vhost-user backend will set the accelerator context via slave channel, > +and QEMU just needs to handle those messages passively. The accelerator > +context will be set for each queue independently. So the page-per-vq property > +should also be enabled. > + > Protocol features > ----------------- > > @@ -327,6 +348,7 @@ Protocol features > #define VHOST_USER_PROTOCOL_F_MTU 4 > #define VHOST_USER_PROTOCOL_F_SLAVE_REQ 5 > #define VHOST_USER_PROTOCOL_F_CROSS_ENDIAN 6 > +#define VHOST_USER_PROTOCOL_F_VFIO 7 > > Master message types > -------------------- > @@ -614,6 +636,41 @@ Slave message types > This request should be send only when VIRTIO_F_IOMMU_PLATFORM feature > has been successfully negotiated. > > + * VHOST_USER_SLAVE_VRING_VFIO_GROUP_MSG > + > + Id: 2 > + Equivalent ioctl: N/A > + Slave payload: u64 > + Master payload: N/A > + > + Sets the VFIO group file descriptor which is passed as ancillary data > + for a specified queue (queue index is carried in the u64 payload). > + Slave sends this request to tell QEMU to add or delete a VFIO group. > + QEMU will delete the current group if any for the specified queue when the > + message is sent without a file descriptor. A VFIO group will be actually > + deleted when its reference count reaches zero. > + This request should be sent only when VHOST_USER_PROTOCOL_F_VFIO protocol > + feature has been successfully negotiated. > + > + * VHOST_USER_SLAVE_VRING_NOTIFY_AREA_MSG > + > + Id: 3 > + Equivalent ioctl: N/A > + Slave payload: vring area description > + Master payload: N/A > + > + Sets the notify area for a specified queue (queue index is carried > + in the u64 field of the vring area description). A file descriptor is > + passed as ancillary data (typically it's a VFIO device fd). QEMU can > + mmap the file descriptor based on the information carried in the vring > + area description. > + Slave sends this request to tell QEMU to add or delete a MemoryRegion > + for a specified queue's notify MMIO region. QEMU will delete the current > + MemoryRegion if any for the specified queue when the message is sent > + without a file descriptor. > + This request should be sent only when VHOST_USER_PROTOCOL_F_VFIO protocol > + feature and VIRTIO_F_VERSION_1 feature have been successfully negotiated. > + > VHOST_USER_PROTOCOL_F_REPLY_ACK: > ------------------------------- > The original vhost-user specification only demands replies for certain > diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c > index 3e308d0a62..ec83746bd5 100644 > --- a/hw/virtio/vhost-user.c > +++ b/hw/virtio/vhost-user.c > @@ -35,6 +35,7 @@ enum VhostUserProtocolFeature { > VHOST_USER_PROTOCOL_F_NET_MTU = 4, > VHOST_USER_PROTOCOL_F_SLAVE_REQ = 5, > VHOST_USER_PROTOCOL_F_CROSS_ENDIAN = 6, > + VHOST_USER_PROTOCOL_F_VFIO = 7, > > VHOST_USER_PROTOCOL_F_MAX > }; > @@ -72,6 +73,8 @@ typedef enum VhostUserRequest { > typedef enum VhostUserSlaveRequest { > VHOST_USER_SLAVE_NONE = 0, > VHOST_USER_SLAVE_IOTLB_MSG = 1, > + VHOST_USER_SLAVE_VRING_VFIO_GROUP_MSG = 2, > + VHOST_USER_SLAVE_VRING_NOTIFY_AREA_MSG = 3, > VHOST_USER_SLAVE_MAX > } VhostUserSlaveRequest; > > @@ -93,6 +96,12 @@ typedef struct VhostUserLog { > uint64_t mmap_offset; > } VhostUserLog; > > +typedef struct VhostUserVringArea { > + uint64_t u64; > + uint64_t size; > + uint64_t offset; > +} VhostUserVringArea; > + > typedef struct VhostUserMsg { > VhostUserRequest request; > > @@ -110,6 +119,7 @@ typedef struct VhostUserMsg { > VhostUserMemory memory; > VhostUserLog log; > struct vhost_iotlb_msg iotlb; > + VhostUserVringArea area; > } payload; > } QEMU_PACKED VhostUserMsg; > > @@ -415,9 +425,37 @@ static int vhost_user_set_vring_num(struct vhost_dev *dev, > return vhost_set_vring(dev, VHOST_USER_SET_VRING_NUM, ring); > } > > +static void vhost_user_notify_region_remap(struct vhost_dev *dev, int queue_idx) > +{ > + struct vhost_user *u = dev->opaque; > + VhostUserVFIOState *vfio = &u->shared->vfio; > + VhostUserNotifyCtx *notify = &vfio->notify[queue_idx]; > + VirtIODevice *vdev = dev->vdev; > + > + if (notify->addr && !notify->mapped) { > + virtio_device_notify_region_map(vdev, queue_idx, ¬ify->mr); > + notify->mapped = true; > + } > +} > + > +static void vhost_user_notify_region_unmap(struct vhost_dev *dev, int queue_idx) > +{ > + struct vhost_user *u = dev->opaque; > + VhostUserVFIOState *vfio = &u->shared->vfio; > + VhostUserNotifyCtx *notify = &vfio->notify[queue_idx]; > + VirtIODevice *vdev = dev->vdev; > + > + if (notify->addr && notify->mapped) { > + virtio_device_notify_region_unmap(vdev, ¬ify->mr); > + notify->mapped = false; > + } > +} > + > static int vhost_user_set_vring_base(struct vhost_dev *dev, > struct vhost_vring_state *ring) > { > + vhost_user_notify_region_remap(dev, ring->index); > + > return vhost_set_vring(dev, VHOST_USER_SET_VRING_BASE, ring); > } > > @@ -451,6 +489,8 @@ static int vhost_user_get_vring_base(struct vhost_dev *dev, > .size = sizeof(msg.payload.state), > }; > > + vhost_user_notify_region_unmap(dev, ring->index); > + > if (vhost_user_write(dev, &msg, NULL, 0) < 0) { > return -1; > } > @@ -609,6 +649,136 @@ static int vhost_user_reset_device(struct vhost_dev *dev) > return 0; > } > > +static int vhost_user_handle_vring_vfio_group(struct vhost_dev *dev, > + uint64_t u64, > + int groupfd) > +{ > + struct vhost_user *u = dev->opaque; > + VhostUserVFIOState *vfio = &u->shared->vfio; > + int queue_idx = u64 & VHOST_USER_VRING_IDX_MASK; > + VirtIODevice *vdev = dev->vdev; > + VFIOGroup *group; > + int ret = 0; > + > + qemu_mutex_lock(&vfio->lock); > + > + if (!virtio_has_feature(dev->protocol_features, > + VHOST_USER_PROTOCOL_F_VFIO) || > + vdev == NULL || > + virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM) || > + queue_idx >= virtio_get_num_queues(vdev)) { > + ret = -1; > + goto out; > + } > + > + if (vfio->group[queue_idx]) { > + vfio_put_group(vfio->group[queue_idx]); > + vfio->group[queue_idx] = NULL; > + } > + > + if (u64 & VHOST_USER_VRING_NOFD_MASK) { > + goto out; > + } > + > + group = vfio_get_group_from_fd(groupfd, NULL, NULL); > + if (group == NULL) { > + ret = -1; > + goto out; > + } > + > + if (group->fd != groupfd) { > + close(groupfd); > + } > + > + vfio->group[queue_idx] = group; > + > +out: > + kvm_irqchip_commit_routes(kvm_state); > + qemu_mutex_unlock(&vfio->lock); > + > + if (ret != 0 && groupfd != -1) { > + close(groupfd); > + } > + > + return ret; > +} > + > +#define NOTIFY_PAGE_SIZE 0x1000 > + > +static int vhost_user_handle_vring_notify_area(struct vhost_dev *dev, > + VhostUserVringArea *area, > + int fd) > +{ > + struct vhost_user *u = dev->opaque; > + VhostUserVFIOState *vfio = &u->shared->vfio; > + int queue_idx = area->u64 & VHOST_USER_VRING_IDX_MASK; > + VirtIODevice *vdev = dev->vdev; > + VhostUserNotifyCtx *notify; > + void *addr = NULL; > + int ret = 0; > + char *name; > + > + qemu_mutex_lock(&vfio->lock); > + > + if (!virtio_has_feature(dev->protocol_features, > + VHOST_USER_PROTOCOL_F_VFIO) || > + vdev == NULL || queue_idx >= virtio_get_num_queues(vdev) || > + virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM) || > + !virtio_device_page_per_vq_enabled(vdev)) { > + ret = -1; > + goto out; > + } > + > + notify = &vfio->notify[queue_idx]; > + > + if (notify->addr) { > + virtio_device_notify_region_unmap(vdev, ¬ify->mr); > + munmap(notify->addr, NOTIFY_PAGE_SIZE); > + object_unparent(OBJECT(¬ify->mr)); > + notify->addr = NULL; > + } > + > + if (area->u64 & VHOST_USER_VRING_NOFD_MASK) { > + goto out; > + } > + > + if (area->size < NOTIFY_PAGE_SIZE) { > + ret = -1; > + goto out; > + } > + > + addr = mmap(NULL, NOTIFY_PAGE_SIZE, PROT_READ | PROT_WRITE, > + MAP_SHARED, fd, area->offset); > + if (addr == MAP_FAILED) { > + error_report("Can't map notify region."); > + ret = -1; > + goto out; > + } > + > + name = g_strdup_printf("vhost-user/vfio@%p mmaps[%d]", vfio, queue_idx); > + memory_region_init_ram_device_ptr(¬ify->mr, OBJECT(vdev), name, > + NOTIFY_PAGE_SIZE, addr); > + g_free(name); > + > + if (virtio_device_notify_region_map(vdev, queue_idx, ¬ify->mr)) { > + ret = -1; > + goto out; > + } > + > + notify->addr = addr; > + notify->mapped = true; > + > +out: > + if (ret < 0 && addr != NULL) { > + munmap(addr, NOTIFY_PAGE_SIZE); > + } > + if (fd != -1) { > + close(fd); > + } > + qemu_mutex_unlock(&vfio->lock); > + return ret; > +} > + > static void slave_read(void *opaque) > { > struct vhost_dev *dev = opaque; > @@ -670,6 +840,12 @@ static void slave_read(void *opaque) > case VHOST_USER_SLAVE_IOTLB_MSG: > ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb); > break; > + case VHOST_USER_SLAVE_VRING_VFIO_GROUP_MSG: > + ret = vhost_user_handle_vring_vfio_group(dev, msg.payload.u64, fd); > + break; > + case VHOST_USER_SLAVE_VRING_NOTIFY_AREA_MSG: > + ret = vhost_user_handle_vring_notify_area(dev, &msg.payload.area, fd); > + break; > default: > error_report("Received unexpected msg type."); > if (fd != -1) { > @@ -772,6 +948,10 @@ static int vhost_user_init(struct vhost_dev *dev, void *opaque) > u->slave_fd = -1; > dev->opaque = u; > > + if (dev->vq_index == 0) { > + qemu_mutex_init(&u->shared->vfio.lock); > + } > + > err = vhost_user_get_features(dev, &features); > if (err < 0) { > return err; > @@ -832,6 +1012,7 @@ static int vhost_user_init(struct vhost_dev *dev, void *opaque) > static int vhost_user_cleanup(struct vhost_dev *dev) > { > struct vhost_user *u; > + int i; > > assert(dev->vhost_ops->backend_type == VHOST_BACKEND_TYPE_USER); > > @@ -841,6 +1022,26 @@ static int vhost_user_cleanup(struct vhost_dev *dev) > close(u->slave_fd); > u->slave_fd = -1; > } > + > + if (dev->vq_index == 0) { > + VhostUserVFIOState *vfio = &u->shared->vfio; > + > + for (i = 0; i < VIRTIO_QUEUE_MAX; i++) { > + if (vfio->notify[i].addr) { > + munmap(vfio->notify[i].addr, NOTIFY_PAGE_SIZE); > + object_unparent(OBJECT(&vfio->notify[i].mr)); > + vfio->notify[i].addr = NULL; > + } > + > + if (vfio->group[i]) { > + vfio_put_group(vfio->group[i]); > + vfio->group[i] = NULL; > + } > + } > + > + qemu_mutex_destroy(&u->shared->vfio.lock); > + } > + > g_free(u); > dev->opaque = 0; > > diff --git a/include/hw/virtio/vhost-user.h b/include/hw/virtio/vhost-user.h > index 4f5a1477d1..de8c647962 100644 > --- a/include/hw/virtio/vhost-user.h > +++ b/include/hw/virtio/vhost-user.h > @@ -9,9 +9,26 @@ > #define HW_VIRTIO_VHOST_USER_H > > #include "chardev/char-fe.h" > +#include "hw/virtio/virtio.h" > +#include "hw/vfio/vfio-common.h" > + > +typedef struct VhostUserNotifyCtx { > + void *addr; > + MemoryRegion mr; > + bool mapped; > +} VhostUserNotifyCtx; > + > +typedef struct VhostUserVFIOState { > + /* The VFIO group associated with each queue */ > + VFIOGroup *group[VIRTIO_QUEUE_MAX]; > + /* The notify context of each queue */ > + VhostUserNotifyCtx notify[VIRTIO_QUEUE_MAX]; > + QemuMutex lock; > +} VhostUserVFIOState; > > typedef struct VhostUser { > CharBackend chr; > + VhostUserVFIOState vfio; > } VhostUser; > > #endif > -- > 2.13.3
On 2018年01月26日 07:59, Michael S. Tsirkin wrote: >> The virtual IOMMU isn't supported by the accelerators for now. >> Because vhost-user currently lacks of an efficient way to share >> the IOMMU table in VM to vhost backend. That's why the software >> implementation of virtual IOMMU support in vhost-user backend >> can't support dynamic mapping well. > What exactly is meant by that? vIOMMU seems to work for people, > it's not that fast if you change mappings all the time, > but e.g. dpdk within guest doesn't. Yes, software implementation support dynamic mapping for sure. I think the point is, current vhost-user backend can not program hardware IOMMU. So it can not let hardware accelerator to cowork with software vIOMMU. I think that's another call to implement the offloaded path inside qemu which has complete support for vIOMMU co-operated VFIO. Thanks > >> Once this problem is solved >> in vhost-user, virtual IOMMU can be supported by accelerators >> too, and the IOMMU feature bit checking in this patch can be >> removed. > Given it works with software backends right now, I suspect > this will be up to you guys to address. >
On Fri, Jan 26, 2018 at 11:41:27AM +0800, Jason Wang wrote: > On 2018年01月26日 07:59, Michael S. Tsirkin wrote: > > > The virtual IOMMU isn't supported by the accelerators for now. > > > Because vhost-user currently lacks of an efficient way to share > > > the IOMMU table in VM to vhost backend. That's why the software > > > implementation of virtual IOMMU support in vhost-user backend > > > can't support dynamic mapping well. > > What exactly is meant by that? vIOMMU seems to work for people, > > it's not that fast if you change mappings all the time, > > but e.g. dpdk within guest doesn't. > > Yes, software implementation support dynamic mapping for sure. I think the > point is, current vhost-user backend can not program hardware IOMMU. So it > can not let hardware accelerator to cowork with software vIOMMU. Vhost-user backend can program hardware IOMMU. Currently vhost-user backend (or more precisely the vDPA driver in vhost-user backend) will use the memory table (delivered by the VHOST_USER_SET_MEM_TABLE message) to program the IOMMU via vfio, and that's why accelerators can use the GPA (guest physical address) in descriptors directly. Theoretically, we can use the IOVA mapping info (delivered by the VHOST_USER_IOTLB_MSG message) to program the IOMMU, and accelerators will be able to use IOVA. But the problem is that in vhost-user QEMU won't push all the IOVA mappings to backend directly. Backend needs to ask for those info when it meets a new IOVA. Such design and implementation won't work well for dynamic mappings anyway and couldn't be supported by hardware accelerators. > I think > that's another call to implement the offloaded path inside qemu which has > complete support for vIOMMU co-operated VFIO. Yes, that's exactly what we want. After revisiting the last paragraph in the commit message, I found it's not really accurate. The practicability of dynamic mappings support is a common issue for QEMU. It also exists for vfio (hw/vfio in QEMU). If QEMU needs to trap all the map/unmap events, the data path performance couldn't be high. If we want to thoroughly fix this issue especially for vfio (hw/vfio in QEMU), we need to have the offload path Jason mentioned in QEMU. And I think accelerators could use it too. Best regards, Tiwei Bie > > Thanks > > > > > > Once this problem is solved > > > in vhost-user, virtual IOMMU can be supported by accelerators > > > too, and the IOMMU feature bit checking in this patch can be > > > removed. > > Given it works with software backends right now, I suspect > > this will be up to you guys to address. > > >
On Thu, Jan 25, 2018 at 9:57 PM, Tiwei Bie <tiwei.bie@intel.com> wrote: > On Fri, Jan 26, 2018 at 11:41:27AM +0800, Jason Wang wrote: >> On 2018年01月26日 07:59, Michael S. Tsirkin wrote: >> > > The virtual IOMMU isn't supported by the accelerators for now. >> > > Because vhost-user currently lacks of an efficient way to share >> > > the IOMMU table in VM to vhost backend. That's why the software >> > > implementation of virtual IOMMU support in vhost-user backend >> > > can't support dynamic mapping well. >> > What exactly is meant by that? vIOMMU seems to work for people, >> > it's not that fast if you change mappings all the time, >> > but e.g. dpdk within guest doesn't. >> >> Yes, software implementation support dynamic mapping for sure. I think the >> point is, current vhost-user backend can not program hardware IOMMU. So it >> can not let hardware accelerator to cowork with software vIOMMU. > > Vhost-user backend can program hardware IOMMU. Currently > vhost-user backend (or more precisely the vDPA driver in > vhost-user backend) will use the memory table (delivered > by the VHOST_USER_SET_MEM_TABLE message) to program the > IOMMU via vfio, and that's why accelerators can use the > GPA (guest physical address) in descriptors directly. > > Theoretically, we can use the IOVA mapping info (delivered > by the VHOST_USER_IOTLB_MSG message) to program the IOMMU, > and accelerators will be able to use IOVA. But the problem > is that in vhost-user QEMU won't push all the IOVA mappings > to backend directly. Backend needs to ask for those info > when it meets a new IOVA. Such design and implementation > won't work well for dynamic mappings anyway and couldn't > be supported by hardware accelerators. > >> I think >> that's another call to implement the offloaded path inside qemu which has >> complete support for vIOMMU co-operated VFIO. > > Yes, that's exactly what we want. After revisiting the > last paragraph in the commit message, I found it's not > really accurate. The practicability of dynamic mappings > support is a common issue for QEMU. It also exists for > vfio (hw/vfio in QEMU). If QEMU needs to trap all the > map/unmap events, the data path performance couldn't be > high. If we want to thoroughly fix this issue especially > for vfio (hw/vfio in QEMU), we need to have the offload > path Jason mentioned in QEMU. And I think accelerators > could use it too. > > Best regards, > Tiwei Bie I wonder if we couldn't look at coming up with an altered security model for the IOMMU drivers to address some of the performance issues seen with typical hardware IOMMU? In the case of most network devices, we seem to be moving toward a model where the Rx pages are mapped for an extended period of time and see a fairly high rate of reuse. As such pages mapped as being writable or read/write by the device are left mapped for an extended period of time while Tx pages, which are read only, are often mapped/unmapped since they are coming from some other location in the kernel beyond the driver's control. If we were to somehow come up with a model where the read-only(Tx) pages had access to a pre-allocated memory mapped address, and the read/write(descriptor rings), write-only(Rx) pages were provided with dynamic addresses we might be able to come up with a solution that would allow for fairly high network performance while at least protecting from memory corruption. The only issue it would open up is that the device would have the ability to read any/all memory on the guest. I was wondering about doing something like this with the vIOMMU with VFIO for the Intel NICs this way since an interface like igb, ixgbe, ixgbevf, i40e, or i40evf would probably show pretty good performance under such a model and as long as the writable pages were being tracked by the vIOMMU. It could even allow for live migration support if the vIOMMU provided the info needed for migratable/dirty page tracking and we held off on migrating any of the dynamically mapped pages until after they were either unmapped or an FLR reset the device. Thanks. - Alex
On 25/01/2018 05:03, Tiwei Bie wrote: > The key difference with PCI passthru is that, in this case only > the data path of the device (e.g. DMA ring, notify region and > queue interrupt) is pass-throughed to the VM, the device control > path (e.g. PCI configuration space and MMIO regions) is still > defined and emulated by QEMU. > > The benefits of keeping virtio device emulation in QEMU compared > with virtio device PCI passthru include (but not limit to): > > - consistent device interface for guest OS in the VM; > - max flexibility on the hardware (i.e. the accelerators) design; > - leveraging the existing virtio live-migration framework; > > The virtual IOMMU isn't supported by the accelerators for now. > Because vhost-user currently lacks of an efficient way to share > the IOMMU table in VM to vhost backend. That's why the software > implementation of virtual IOMMU support in vhost-user backend > can't support dynamic mapping well. Once this problem is solved > in vhost-user, virtual IOMMU can be supported by accelerators > too, and the IOMMU feature bit checking in this patch can be > removed. I don't understand why this would use vhost-user. vhost-user is meant for connecting to e.g. a user-space switch that is shared between multiple virtual machines. In this case, there would be one VFIO device per VM (because different VM must be in different VFIO groups). So I don't understand the benefit of configuring the control path of the VFIO device outside QEMU. Paolo
On Mon, Feb 05, 2018 at 06:47:51PM +0100, Paolo Bonzini wrote: > On 25/01/2018 05:03, Tiwei Bie wrote: > > The key difference with PCI passthru is that, in this case only > > the data path of the device (e.g. DMA ring, notify region and > > queue interrupt) is pass-throughed to the VM, the device control > > path (e.g. PCI configuration space and MMIO regions) is still > > defined and emulated by QEMU. > > > > The benefits of keeping virtio device emulation in QEMU compared > > with virtio device PCI passthru include (but not limit to): > > > > - consistent device interface for guest OS in the VM; > > - max flexibility on the hardware (i.e. the accelerators) design; > > - leveraging the existing virtio live-migration framework; > > > > The virtual IOMMU isn't supported by the accelerators for now. > > Because vhost-user currently lacks of an efficient way to share > > the IOMMU table in VM to vhost backend. That's why the software > > implementation of virtual IOMMU support in vhost-user backend > > can't support dynamic mapping well. Once this problem is solved > > in vhost-user, virtual IOMMU can be supported by accelerators > > too, and the IOMMU feature bit checking in this patch can be > > removed. > > I don't understand why this would use vhost-user. vhost-user is meant > for connecting to e.g. a user-space switch that is shared between > multiple virtual machines. Yeah, you're right! The commit log you quoted is talking about the benefits of vDPA (i.e. only passthru the data path), which is not related to vhost-user. The usage of vhost-user you described is exactly why we want to use vhost-user. In our case, the accelerator for each VM is a PCI VF device and the PCI card has vswitch logic (the VFs are the ports of switch to connect VMs). So the card is a vswitch accelerator which will be shared between multiple VMs. If we extend vhost-user, QEMU can keep using the vhost-user interface to connect to the user-space switch which has an optional accelerator. More details can be found in the "Why extend vhost-user for vDPA" section of the cover letter: ----- START ----- Why extend vhost-user for vDPA ============================== We have already implemented various virtual switches (e.g. OVS-DPDK) based on vhost-user for VMs in the Cloud. They are purely software running on CPU cores. When we have accelerators for such NFVi applications, it's ideal if the applications could keep using the original interface (i.e. vhost-user netdev) with QEMU, and infrastructure is able to decide when and how to switch between CPU and accelerators within the interface. And the switching (i.e. switch between CPU and accelerators) can be done flexibly and quickly inside the applications. ----- END ----- I'll try to add these infos into the commit log. Thanks! Best regards, Tiwei Bie > > In this case, there would be one VFIO device per VM (because different > VM must be in different VFIO groups). So I don't understand the benefit > of configuring the control path of the VFIO device outside QEMU. > > Paolo
On 06/02/2018 05:40, Tiwei Bie wrote: > In our case, the accelerator for > each VM is a PCI VF device and the PCI card has vswitch > logic (the VFs are the ports of switch to connect VMs). Ok, this makes a lot more sense now. :) Paolo > So the card is a vswitch accelerator which will be shared > between multiple VMs.
On Sun, Feb 04, 2018 at 01:49:46PM -0800, Alexander Duyck wrote: > On Thu, Jan 25, 2018 at 9:57 PM, Tiwei Bie <tiwei.bie@intel.com> wrote: > > On Fri, Jan 26, 2018 at 11:41:27AM +0800, Jason Wang wrote: > >> On 2018年01月26日 07:59, Michael S. Tsirkin wrote: > >> > > The virtual IOMMU isn't supported by the accelerators for now. > >> > > Because vhost-user currently lacks of an efficient way to share > >> > > the IOMMU table in VM to vhost backend. That's why the software > >> > > implementation of virtual IOMMU support in vhost-user backend > >> > > can't support dynamic mapping well. > >> > What exactly is meant by that? vIOMMU seems to work for people, > >> > it's not that fast if you change mappings all the time, > >> > but e.g. dpdk within guest doesn't. > >> > >> Yes, software implementation support dynamic mapping for sure. I think the > >> point is, current vhost-user backend can not program hardware IOMMU. So it > >> can not let hardware accelerator to cowork with software vIOMMU. > > > > Vhost-user backend can program hardware IOMMU. Currently > > vhost-user backend (or more precisely the vDPA driver in > > vhost-user backend) will use the memory table (delivered > > by the VHOST_USER_SET_MEM_TABLE message) to program the > > IOMMU via vfio, and that's why accelerators can use the > > GPA (guest physical address) in descriptors directly. > > > > Theoretically, we can use the IOVA mapping info (delivered > > by the VHOST_USER_IOTLB_MSG message) to program the IOMMU, > > and accelerators will be able to use IOVA. But the problem > > is that in vhost-user QEMU won't push all the IOVA mappings > > to backend directly. Backend needs to ask for those info > > when it meets a new IOVA. Such design and implementation > > won't work well for dynamic mappings anyway and couldn't > > be supported by hardware accelerators. > > > >> I think > >> that's another call to implement the offloaded path inside qemu which has > >> complete support for vIOMMU co-operated VFIO. > > > > Yes, that's exactly what we want. After revisiting the > > last paragraph in the commit message, I found it's not > > really accurate. The practicability of dynamic mappings > > support is a common issue for QEMU. It also exists for > > vfio (hw/vfio in QEMU). If QEMU needs to trap all the > > map/unmap events, the data path performance couldn't be > > high. If we want to thoroughly fix this issue especially > > for vfio (hw/vfio in QEMU), we need to have the offload > > path Jason mentioned in QEMU. And I think accelerators > > could use it too. > > > > Best regards, > > Tiwei Bie > > I wonder if we couldn't look at coming up with an altered security > model for the IOMMU drivers to address some of the performance issues > seen with typical hardware IOMMU? > > In the case of most network devices, we seem to be moving toward a > model where the Rx pages are mapped for an extended period of time and > see a fairly high rate of reuse. As such pages mapped as being > writable or read/write by the device are left mapped for an extended > period of time while Tx pages, which are read only, are often > mapped/unmapped since they are coming from some other location in the > kernel beyond the driver's control. > > If we were to somehow come up with a model where the read-only(Tx) > pages had access to a pre-allocated memory mapped address, and the > read/write(descriptor rings), write-only(Rx) pages were provided with > dynamic addresses we might be able to come up with a solution that > would allow for fairly high network performance while at least > protecting from memory corruption. The only issue it would open up is > that the device would have the ability to read any/all memory on the > guest. I was wondering about doing something like this with the vIOMMU > with VFIO for the Intel NICs this way since an interface like igb, > ixgbe, ixgbevf, i40e, or i40evf would probably show pretty good > performance under such a model and as long as the writable pages were > being tracked by the vIOMMU. It could even allow for live migration > support if the vIOMMU provided the info needed for migratable/dirty > page tracking and we held off on migrating any of the dynamically > mapped pages until after they were either unmapped or an FLR reset the > device. > > Thanks. > > - Alex It might be a good idea to change the iommu instead - how about a variant of strict in intel iommu which forces an IOTLB flush after invalidating a writeable mapping but not a RO mapping? Not sure what the name would be - relaxed-ro? This is probably easier than poking at the drivers and net core. Keeping the RX pages mapped in the IOMMU was envisioned for XDP. That might be a good place to start.
On Wed, Feb 7, 2018 at 8:43 AM, Michael S. Tsirkin <mst@redhat.com> wrote: > On Sun, Feb 04, 2018 at 01:49:46PM -0800, Alexander Duyck wrote: >> On Thu, Jan 25, 2018 at 9:57 PM, Tiwei Bie <tiwei.bie@intel.com> wrote: >> > On Fri, Jan 26, 2018 at 11:41:27AM +0800, Jason Wang wrote: >> >> On 2018年01月26日 07:59, Michael S. Tsirkin wrote: >> >> > > The virtual IOMMU isn't supported by the accelerators for now. >> >> > > Because vhost-user currently lacks of an efficient way to share >> >> > > the IOMMU table in VM to vhost backend. That's why the software >> >> > > implementation of virtual IOMMU support in vhost-user backend >> >> > > can't support dynamic mapping well. >> >> > What exactly is meant by that? vIOMMU seems to work for people, >> >> > it's not that fast if you change mappings all the time, >> >> > but e.g. dpdk within guest doesn't. >> >> >> >> Yes, software implementation support dynamic mapping for sure. I think the >> >> point is, current vhost-user backend can not program hardware IOMMU. So it >> >> can not let hardware accelerator to cowork with software vIOMMU. >> > >> > Vhost-user backend can program hardware IOMMU. Currently >> > vhost-user backend (or more precisely the vDPA driver in >> > vhost-user backend) will use the memory table (delivered >> > by the VHOST_USER_SET_MEM_TABLE message) to program the >> > IOMMU via vfio, and that's why accelerators can use the >> > GPA (guest physical address) in descriptors directly. >> > >> > Theoretically, we can use the IOVA mapping info (delivered >> > by the VHOST_USER_IOTLB_MSG message) to program the IOMMU, >> > and accelerators will be able to use IOVA. But the problem >> > is that in vhost-user QEMU won't push all the IOVA mappings >> > to backend directly. Backend needs to ask for those info >> > when it meets a new IOVA. Such design and implementation >> > won't work well for dynamic mappings anyway and couldn't >> > be supported by hardware accelerators. >> > >> >> I think >> >> that's another call to implement the offloaded path inside qemu which has >> >> complete support for vIOMMU co-operated VFIO. >> > >> > Yes, that's exactly what we want. After revisiting the >> > last paragraph in the commit message, I found it's not >> > really accurate. The practicability of dynamic mappings >> > support is a common issue for QEMU. It also exists for >> > vfio (hw/vfio in QEMU). If QEMU needs to trap all the >> > map/unmap events, the data path performance couldn't be >> > high. If we want to thoroughly fix this issue especially >> > for vfio (hw/vfio in QEMU), we need to have the offload >> > path Jason mentioned in QEMU. And I think accelerators >> > could use it too. >> > >> > Best regards, >> > Tiwei Bie >> >> I wonder if we couldn't look at coming up with an altered security >> model for the IOMMU drivers to address some of the performance issues >> seen with typical hardware IOMMU? >> >> In the case of most network devices, we seem to be moving toward a >> model where the Rx pages are mapped for an extended period of time and >> see a fairly high rate of reuse. As such pages mapped as being >> writable or read/write by the device are left mapped for an extended >> period of time while Tx pages, which are read only, are often >> mapped/unmapped since they are coming from some other location in the >> kernel beyond the driver's control. >> >> If we were to somehow come up with a model where the read-only(Tx) >> pages had access to a pre-allocated memory mapped address, and the >> read/write(descriptor rings), write-only(Rx) pages were provided with >> dynamic addresses we might be able to come up with a solution that >> would allow for fairly high network performance while at least >> protecting from memory corruption. The only issue it would open up is >> that the device would have the ability to read any/all memory on the >> guest. I was wondering about doing something like this with the vIOMMU >> with VFIO for the Intel NICs this way since an interface like igb, >> ixgbe, ixgbevf, i40e, or i40evf would probably show pretty good >> performance under such a model and as long as the writable pages were >> being tracked by the vIOMMU. It could even allow for live migration >> support if the vIOMMU provided the info needed for migratable/dirty >> page tracking and we held off on migrating any of the dynamically >> mapped pages until after they were either unmapped or an FLR reset the >> device. >> >> Thanks. >> >> - Alex > > > > It might be a good idea to change the iommu instead - how about a > variant of strict in intel iommu which forces an IOTLB flush after > invalidating a writeable mapping but not a RO mapping? Not sure what the > name would be - relaxed-ro? > > This is probably easier than poking at the drivers and net core. > > Keeping the RX pages mapped in the IOMMU was envisioned for XDP. > That might be a good place to start. My plan is to update the Intel IOMMU driver first since it seems like something that shouldn't require too much expertise in the operation of the IOMMU to accomplish. My idea was more along the lines of something like a "iommu=read-only-pt" or maybe "iommu=pt-ro" where the Tx data would be identity mapped, and the descriptor rings and Rx data could be in the dynamic mapping setup. The idea is loosely based on the existing "iommu=pt" option that is normally used on the host if you want to avoid the cost for dynamic mapping. Basically we just need to keep an eye on the number of mappings that the device can write to. Ideally if we leave the Tx as identity mapped that means we never have to actually write to update any mapping which would mean no having to jump into the hypervisor to deal with the update. The fact that most of the drivers already leave the Rx buffers and descriptor rings statically mapped should essentially take care of the rest for us. What this would become is a version of "iommu=pt" where the user cares about preventing the device from possibly corrupting memory, but would still like better performance at the cost of the device being able to ready and/all memory on the system. As far as if it is strict or not I don't know how much we would need to worry about that for the migration case. Essentially a deferred IOTLB flush would result in us having extra pages marked as dirty and non-migratable, but we would need to see how much overhead there is in the migration to deal with those extra pages versus the cost of having to do an IOTLB flush on every unmap call. Anyway this is an idea that just occurred to me the other day so I still need to do some more research into how easy/difficult implementing a solution like this would be. Thanks. - Alex
On Wed, Feb 07, 2018 at 10:02:24AM -0800, Alexander Duyck wrote: > On Wed, Feb 7, 2018 at 8:43 AM, Michael S. Tsirkin <mst@redhat.com> wrote: > > On Sun, Feb 04, 2018 at 01:49:46PM -0800, Alexander Duyck wrote: > >> On Thu, Jan 25, 2018 at 9:57 PM, Tiwei Bie <tiwei.bie@intel.com> wrote: > >> > On Fri, Jan 26, 2018 at 11:41:27AM +0800, Jason Wang wrote: > >> >> On 2018年01月26日 07:59, Michael S. Tsirkin wrote: > >> >> > > The virtual IOMMU isn't supported by the accelerators for now. > >> >> > > Because vhost-user currently lacks of an efficient way to share > >> >> > > the IOMMU table in VM to vhost backend. That's why the software > >> >> > > implementation of virtual IOMMU support in vhost-user backend > >> >> > > can't support dynamic mapping well. > >> >> > What exactly is meant by that? vIOMMU seems to work for people, > >> >> > it's not that fast if you change mappings all the time, > >> >> > but e.g. dpdk within guest doesn't. > >> >> > >> >> Yes, software implementation support dynamic mapping for sure. I think the > >> >> point is, current vhost-user backend can not program hardware IOMMU. So it > >> >> can not let hardware accelerator to cowork with software vIOMMU. > >> > > >> > Vhost-user backend can program hardware IOMMU. Currently > >> > vhost-user backend (or more precisely the vDPA driver in > >> > vhost-user backend) will use the memory table (delivered > >> > by the VHOST_USER_SET_MEM_TABLE message) to program the > >> > IOMMU via vfio, and that's why accelerators can use the > >> > GPA (guest physical address) in descriptors directly. > >> > > >> > Theoretically, we can use the IOVA mapping info (delivered > >> > by the VHOST_USER_IOTLB_MSG message) to program the IOMMU, > >> > and accelerators will be able to use IOVA. But the problem > >> > is that in vhost-user QEMU won't push all the IOVA mappings > >> > to backend directly. Backend needs to ask for those info > >> > when it meets a new IOVA. Such design and implementation > >> > won't work well for dynamic mappings anyway and couldn't > >> > be supported by hardware accelerators. > >> > > >> >> I think > >> >> that's another call to implement the offloaded path inside qemu which has > >> >> complete support for vIOMMU co-operated VFIO. > >> > > >> > Yes, that's exactly what we want. After revisiting the > >> > last paragraph in the commit message, I found it's not > >> > really accurate. The practicability of dynamic mappings > >> > support is a common issue for QEMU. It also exists for > >> > vfio (hw/vfio in QEMU). If QEMU needs to trap all the > >> > map/unmap events, the data path performance couldn't be > >> > high. If we want to thoroughly fix this issue especially > >> > for vfio (hw/vfio in QEMU), we need to have the offload > >> > path Jason mentioned in QEMU. And I think accelerators > >> > could use it too. > >> > > >> > Best regards, > >> > Tiwei Bie > >> > >> I wonder if we couldn't look at coming up with an altered security > >> model for the IOMMU drivers to address some of the performance issues > >> seen with typical hardware IOMMU? > >> > >> In the case of most network devices, we seem to be moving toward a > >> model where the Rx pages are mapped for an extended period of time and > >> see a fairly high rate of reuse. As such pages mapped as being > >> writable or read/write by the device are left mapped for an extended > >> period of time while Tx pages, which are read only, are often > >> mapped/unmapped since they are coming from some other location in the > >> kernel beyond the driver's control. > >> > >> If we were to somehow come up with a model where the read-only(Tx) > >> pages had access to a pre-allocated memory mapped address, and the > >> read/write(descriptor rings), write-only(Rx) pages were provided with > >> dynamic addresses we might be able to come up with a solution that > >> would allow for fairly high network performance while at least > >> protecting from memory corruption. The only issue it would open up is > >> that the device would have the ability to read any/all memory on the > >> guest. I was wondering about doing something like this with the vIOMMU > >> with VFIO for the Intel NICs this way since an interface like igb, > >> ixgbe, ixgbevf, i40e, or i40evf would probably show pretty good > >> performance under such a model and as long as the writable pages were > >> being tracked by the vIOMMU. It could even allow for live migration > >> support if the vIOMMU provided the info needed for migratable/dirty > >> page tracking and we held off on migrating any of the dynamically > >> mapped pages until after they were either unmapped or an FLR reset the > >> device. > >> > >> Thanks. > >> > >> - Alex > > > > > > > > It might be a good idea to change the iommu instead - how about a > > variant of strict in intel iommu which forces an IOTLB flush after > > invalidating a writeable mapping but not a RO mapping? Not sure what the > > name would be - relaxed-ro? > > > > This is probably easier than poking at the drivers and net core. > > > > Keeping the RX pages mapped in the IOMMU was envisioned for XDP. > > That might be a good place to start. > > My plan is to update the Intel IOMMU driver first since it seems like > something that shouldn't require too much expertise in the operation > of the IOMMU to accomplish. My idea was more along the lines of > something like a "iommu=read-only-pt" or maybe "iommu=pt-ro" where the > Tx data would be identity mapped, and the descriptor rings and Rx data > could be in the dynamic mapping setup. The idea is loosely based on > the existing "iommu=pt" option that is normally used on the host if > you want to avoid the cost for dynamic mapping. Basically we just need > to keep an eye on the number of mappings that the device can write to. > Ideally if we leave the Tx as identity mapped that means we never have > to actually write to update any mapping which would mean no having to > jump into the hypervisor to deal with the update. Just noting that updating page tables does not require jumping to the hypervisor by itself. Only invalidation requires that. > The fact that most > of the drivers already leave the Rx buffers and descriptor rings > statically mapped should essentially take care of the rest for us. > What this would become is a version of "iommu=pt" where the user cares > about preventing the device from possibly corrupting memory, but would > still like better performance at the cost of the device being able to > ready and/all memory on the system. > > As far as if it is strict or not I don't know how much we would need > to worry about that for the migration case. Essentially a deferred > IOTLB flush would result in us having extra pages marked as dirty and > non-migratable, but we would need to see how much overhead there is in > the migration to deal with those extra pages versus the cost of having > to do an IOTLB flush on every unmap call. > > Anyway this is an idea that just occurred to me the other day so I > still need to do some more research into how easy/difficult > implementing a solution like this would be. > > Thanks. > > - Alex Right. And I think if you do a straight pt, then this is not a security as much as a robustness feature. I guess both have a place under the sun.
diff --git a/docs/interop/vhost-user.txt b/docs/interop/vhost-user.txt index 954771d0d8..15e917019a 100644 --- a/docs/interop/vhost-user.txt +++ b/docs/interop/vhost-user.txt @@ -116,6 +116,15 @@ Depending on the request type, payload can be: - 3: IOTLB invalidate - 4: IOTLB access fail + * Vring area description + ----------------------- + | u64 | size | offset | + ----------------------- + + u64: a 64-bit unsigned integer + Size: a 64-bit size + Offset: a 64-bit offset + In QEMU the vhost-user message is implemented with the following struct: typedef struct VhostUserMsg { @@ -129,6 +138,7 @@ typedef struct VhostUserMsg { VhostUserMemory memory; VhostUserLog log; struct vhost_iotlb_msg iotlb; + VhostUserVringArea area; }; } QEMU_PACKED VhostUserMsg; @@ -317,6 +327,17 @@ The fd is provided via VHOST_USER_SET_SLAVE_REQ_FD ancillary data. A slave may then send VHOST_USER_SLAVE_* messages to the master using this fd communication channel. +VFIO based accelerators +----------------------- + +The VFIO based accelerators feature is a protocol extension. It is supported +when the protocol feature VHOST_USER_PROTOCOL_F_VFIO (bit 7) is set. + +The vhost-user backend will set the accelerator context via slave channel, +and QEMU just needs to handle those messages passively. The accelerator +context will be set for each queue independently. So the page-per-vq property +should also be enabled. + Protocol features ----------------- @@ -327,6 +348,7 @@ Protocol features #define VHOST_USER_PROTOCOL_F_MTU 4 #define VHOST_USER_PROTOCOL_F_SLAVE_REQ 5 #define VHOST_USER_PROTOCOL_F_CROSS_ENDIAN 6 +#define VHOST_USER_PROTOCOL_F_VFIO 7 Master message types -------------------- @@ -614,6 +636,41 @@ Slave message types This request should be send only when VIRTIO_F_IOMMU_PLATFORM feature has been successfully negotiated. + * VHOST_USER_SLAVE_VRING_VFIO_GROUP_MSG + + Id: 2 + Equivalent ioctl: N/A + Slave payload: u64 + Master payload: N/A + + Sets the VFIO group file descriptor which is passed as ancillary data + for a specified queue (queue index is carried in the u64 payload). + Slave sends this request to tell QEMU to add or delete a VFIO group. + QEMU will delete the current group if any for the specified queue when the + message is sent without a file descriptor. A VFIO group will be actually + deleted when its reference count reaches zero. + This request should be sent only when VHOST_USER_PROTOCOL_F_VFIO protocol + feature has been successfully negotiated. + + * VHOST_USER_SLAVE_VRING_NOTIFY_AREA_MSG + + Id: 3 + Equivalent ioctl: N/A + Slave payload: vring area description + Master payload: N/A + + Sets the notify area for a specified queue (queue index is carried + in the u64 field of the vring area description). A file descriptor is + passed as ancillary data (typically it's a VFIO device fd). QEMU can + mmap the file descriptor based on the information carried in the vring + area description. + Slave sends this request to tell QEMU to add or delete a MemoryRegion + for a specified queue's notify MMIO region. QEMU will delete the current + MemoryRegion if any for the specified queue when the message is sent + without a file descriptor. + This request should be sent only when VHOST_USER_PROTOCOL_F_VFIO protocol + feature and VIRTIO_F_VERSION_1 feature have been successfully negotiated. + VHOST_USER_PROTOCOL_F_REPLY_ACK: ------------------------------- The original vhost-user specification only demands replies for certain diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 3e308d0a62..ec83746bd5 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -35,6 +35,7 @@ enum VhostUserProtocolFeature { VHOST_USER_PROTOCOL_F_NET_MTU = 4, VHOST_USER_PROTOCOL_F_SLAVE_REQ = 5, VHOST_USER_PROTOCOL_F_CROSS_ENDIAN = 6, + VHOST_USER_PROTOCOL_F_VFIO = 7, VHOST_USER_PROTOCOL_F_MAX }; @@ -72,6 +73,8 @@ typedef enum VhostUserRequest { typedef enum VhostUserSlaveRequest { VHOST_USER_SLAVE_NONE = 0, VHOST_USER_SLAVE_IOTLB_MSG = 1, + VHOST_USER_SLAVE_VRING_VFIO_GROUP_MSG = 2, + VHOST_USER_SLAVE_VRING_NOTIFY_AREA_MSG = 3, VHOST_USER_SLAVE_MAX } VhostUserSlaveRequest; @@ -93,6 +96,12 @@ typedef struct VhostUserLog { uint64_t mmap_offset; } VhostUserLog; +typedef struct VhostUserVringArea { + uint64_t u64; + uint64_t size; + uint64_t offset; +} VhostUserVringArea; + typedef struct VhostUserMsg { VhostUserRequest request; @@ -110,6 +119,7 @@ typedef struct VhostUserMsg { VhostUserMemory memory; VhostUserLog log; struct vhost_iotlb_msg iotlb; + VhostUserVringArea area; } payload; } QEMU_PACKED VhostUserMsg; @@ -415,9 +425,37 @@ static int vhost_user_set_vring_num(struct vhost_dev *dev, return vhost_set_vring(dev, VHOST_USER_SET_VRING_NUM, ring); } +static void vhost_user_notify_region_remap(struct vhost_dev *dev, int queue_idx) +{ + struct vhost_user *u = dev->opaque; + VhostUserVFIOState *vfio = &u->shared->vfio; + VhostUserNotifyCtx *notify = &vfio->notify[queue_idx]; + VirtIODevice *vdev = dev->vdev; + + if (notify->addr && !notify->mapped) { + virtio_device_notify_region_map(vdev, queue_idx, ¬ify->mr); + notify->mapped = true; + } +} + +static void vhost_user_notify_region_unmap(struct vhost_dev *dev, int queue_idx) +{ + struct vhost_user *u = dev->opaque; + VhostUserVFIOState *vfio = &u->shared->vfio; + VhostUserNotifyCtx *notify = &vfio->notify[queue_idx]; + VirtIODevice *vdev = dev->vdev; + + if (notify->addr && notify->mapped) { + virtio_device_notify_region_unmap(vdev, ¬ify->mr); + notify->mapped = false; + } +} + static int vhost_user_set_vring_base(struct vhost_dev *dev, struct vhost_vring_state *ring) { + vhost_user_notify_region_remap(dev, ring->index); + return vhost_set_vring(dev, VHOST_USER_SET_VRING_BASE, ring); } @@ -451,6 +489,8 @@ static int vhost_user_get_vring_base(struct vhost_dev *dev, .size = sizeof(msg.payload.state), }; + vhost_user_notify_region_unmap(dev, ring->index); + if (vhost_user_write(dev, &msg, NULL, 0) < 0) { return -1; } @@ -609,6 +649,136 @@ static int vhost_user_reset_device(struct vhost_dev *dev) return 0; } +static int vhost_user_handle_vring_vfio_group(struct vhost_dev *dev, + uint64_t u64, + int groupfd) +{ + struct vhost_user *u = dev->opaque; + VhostUserVFIOState *vfio = &u->shared->vfio; + int queue_idx = u64 & VHOST_USER_VRING_IDX_MASK; + VirtIODevice *vdev = dev->vdev; + VFIOGroup *group; + int ret = 0; + + qemu_mutex_lock(&vfio->lock); + + if (!virtio_has_feature(dev->protocol_features, + VHOST_USER_PROTOCOL_F_VFIO) || + vdev == NULL || + virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM) || + queue_idx >= virtio_get_num_queues(vdev)) { + ret = -1; + goto out; + } + + if (vfio->group[queue_idx]) { + vfio_put_group(vfio->group[queue_idx]); + vfio->group[queue_idx] = NULL; + } + + if (u64 & VHOST_USER_VRING_NOFD_MASK) { + goto out; + } + + group = vfio_get_group_from_fd(groupfd, NULL, NULL); + if (group == NULL) { + ret = -1; + goto out; + } + + if (group->fd != groupfd) { + close(groupfd); + } + + vfio->group[queue_idx] = group; + +out: + kvm_irqchip_commit_routes(kvm_state); + qemu_mutex_unlock(&vfio->lock); + + if (ret != 0 && groupfd != -1) { + close(groupfd); + } + + return ret; +} + +#define NOTIFY_PAGE_SIZE 0x1000 + +static int vhost_user_handle_vring_notify_area(struct vhost_dev *dev, + VhostUserVringArea *area, + int fd) +{ + struct vhost_user *u = dev->opaque; + VhostUserVFIOState *vfio = &u->shared->vfio; + int queue_idx = area->u64 & VHOST_USER_VRING_IDX_MASK; + VirtIODevice *vdev = dev->vdev; + VhostUserNotifyCtx *notify; + void *addr = NULL; + int ret = 0; + char *name; + + qemu_mutex_lock(&vfio->lock); + + if (!virtio_has_feature(dev->protocol_features, + VHOST_USER_PROTOCOL_F_VFIO) || + vdev == NULL || queue_idx >= virtio_get_num_queues(vdev) || + virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM) || + !virtio_device_page_per_vq_enabled(vdev)) { + ret = -1; + goto out; + } + + notify = &vfio->notify[queue_idx]; + + if (notify->addr) { + virtio_device_notify_region_unmap(vdev, ¬ify->mr); + munmap(notify->addr, NOTIFY_PAGE_SIZE); + object_unparent(OBJECT(¬ify->mr)); + notify->addr = NULL; + } + + if (area->u64 & VHOST_USER_VRING_NOFD_MASK) { + goto out; + } + + if (area->size < NOTIFY_PAGE_SIZE) { + ret = -1; + goto out; + } + + addr = mmap(NULL, NOTIFY_PAGE_SIZE, PROT_READ | PROT_WRITE, + MAP_SHARED, fd, area->offset); + if (addr == MAP_FAILED) { + error_report("Can't map notify region."); + ret = -1; + goto out; + } + + name = g_strdup_printf("vhost-user/vfio@%p mmaps[%d]", vfio, queue_idx); + memory_region_init_ram_device_ptr(¬ify->mr, OBJECT(vdev), name, + NOTIFY_PAGE_SIZE, addr); + g_free(name); + + if (virtio_device_notify_region_map(vdev, queue_idx, ¬ify->mr)) { + ret = -1; + goto out; + } + + notify->addr = addr; + notify->mapped = true; + +out: + if (ret < 0 && addr != NULL) { + munmap(addr, NOTIFY_PAGE_SIZE); + } + if (fd != -1) { + close(fd); + } + qemu_mutex_unlock(&vfio->lock); + return ret; +} + static void slave_read(void *opaque) { struct vhost_dev *dev = opaque; @@ -670,6 +840,12 @@ static void slave_read(void *opaque) case VHOST_USER_SLAVE_IOTLB_MSG: ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb); break; + case VHOST_USER_SLAVE_VRING_VFIO_GROUP_MSG: + ret = vhost_user_handle_vring_vfio_group(dev, msg.payload.u64, fd); + break; + case VHOST_USER_SLAVE_VRING_NOTIFY_AREA_MSG: + ret = vhost_user_handle_vring_notify_area(dev, &msg.payload.area, fd); + break; default: error_report("Received unexpected msg type."); if (fd != -1) { @@ -772,6 +948,10 @@ static int vhost_user_init(struct vhost_dev *dev, void *opaque) u->slave_fd = -1; dev->opaque = u; + if (dev->vq_index == 0) { + qemu_mutex_init(&u->shared->vfio.lock); + } + err = vhost_user_get_features(dev, &features); if (err < 0) { return err; @@ -832,6 +1012,7 @@ static int vhost_user_init(struct vhost_dev *dev, void *opaque) static int vhost_user_cleanup(struct vhost_dev *dev) { struct vhost_user *u; + int i; assert(dev->vhost_ops->backend_type == VHOST_BACKEND_TYPE_USER); @@ -841,6 +1022,26 @@ static int vhost_user_cleanup(struct vhost_dev *dev) close(u->slave_fd); u->slave_fd = -1; } + + if (dev->vq_index == 0) { + VhostUserVFIOState *vfio = &u->shared->vfio; + + for (i = 0; i < VIRTIO_QUEUE_MAX; i++) { + if (vfio->notify[i].addr) { + munmap(vfio->notify[i].addr, NOTIFY_PAGE_SIZE); + object_unparent(OBJECT(&vfio->notify[i].mr)); + vfio->notify[i].addr = NULL; + } + + if (vfio->group[i]) { + vfio_put_group(vfio->group[i]); + vfio->group[i] = NULL; + } + } + + qemu_mutex_destroy(&u->shared->vfio.lock); + } + g_free(u); dev->opaque = 0; diff --git a/include/hw/virtio/vhost-user.h b/include/hw/virtio/vhost-user.h index 4f5a1477d1..de8c647962 100644 --- a/include/hw/virtio/vhost-user.h +++ b/include/hw/virtio/vhost-user.h @@ -9,9 +9,26 @@ #define HW_VIRTIO_VHOST_USER_H #include "chardev/char-fe.h" +#include "hw/virtio/virtio.h" +#include "hw/vfio/vfio-common.h" + +typedef struct VhostUserNotifyCtx { + void *addr; + MemoryRegion mr; + bool mapped; +} VhostUserNotifyCtx; + +typedef struct VhostUserVFIOState { + /* The VFIO group associated with each queue */ + VFIOGroup *group[VIRTIO_QUEUE_MAX]; + /* The notify context of each queue */ + VhostUserNotifyCtx notify[VIRTIO_QUEUE_MAX]; + QemuMutex lock; +} VhostUserVFIOState; typedef struct VhostUser { CharBackend chr; + VhostUserVFIOState vfio; } VhostUser; #endif
This patch does some small extensions to vhost-user protocol to support VFIO based accelerators, and makes it possible to get the similar performance of VFIO based PCI passthru while keeping the virtio device emulation in QEMU. Any virtio ring compatible devices potentially can be used as the vhost data path accelerators. We can setup the accelerator based on the informations (e.g. memory table, features, ring info, etc) available on the vhost backend. And accelerator will be able to use the virtio ring provided by the virtio driver in the VM directly. So the virtio driver in the VM can exchange e.g. network packets with the accelerator directly via the virtio ring. But for vhost-user, the critical issue in this case is that the data path performance is relatively low and some host threads are needed for the data path, because some necessary mechanisms are missing to support: 1) guest driver notifies the device directly; 2) device interrupts the guest directly; So this patch does some small extensions to vhost-user protocol to make both of them possible. It leverages the same mechanisms as the VFIO based PCI passthru. A new protocol feature bit is added to negotiate the accelerator feature support. Two new slave message types are added to control the notify region and queue interrupt passthru for each queue. From the view of vhost-user protocol design, it's very flexible. The passthru can be enabled/disabled for each queue individually, and it's possible to accelerate each queue by different devices. The key difference with PCI passthru is that, in this case only the data path of the device (e.g. DMA ring, notify region and queue interrupt) is pass-throughed to the VM, the device control path (e.g. PCI configuration space and MMIO regions) is still defined and emulated by QEMU. The benefits of keeping virtio device emulation in QEMU compared with virtio device PCI passthru include (but not limit to): - consistent device interface for guest OS in the VM; - max flexibility on the hardware (i.e. the accelerators) design; - leveraging the existing virtio live-migration framework; The virtual IOMMU isn't supported by the accelerators for now. Because vhost-user currently lacks of an efficient way to share the IOMMU table in VM to vhost backend. That's why the software implementation of virtual IOMMU support in vhost-user backend can't support dynamic mapping well. Once this problem is solved in vhost-user, virtual IOMMU can be supported by accelerators too, and the IOMMU feature bit checking in this patch can be removed. Signed-off-by: Tiwei Bie <tiwei.bie@intel.com> --- docs/interop/vhost-user.txt | 57 ++++++++++++ hw/virtio/vhost-user.c | 201 +++++++++++++++++++++++++++++++++++++++++ include/hw/virtio/vhost-user.h | 17 ++++ 3 files changed, 275 insertions(+)