Re: [Qemu-devel] snabbswitch integration with QEMU for userspace ethernet I/O

[Julian Stecklina]

On 05/28/2013 01:53 PM, Michael S. Tsirkin wrote:
> Implementing out of process device logic would absolutely be useful for
> qemu, for security.
> 
> Don't expect it to be zero overhead though, latency overhead
> of bouncing each packet through multiple processes would
> be especially painful.

Currently, latency for vhost is also quite bad compared to what it could
be, because for VM-to-VM packets usually 4 CPUs are involved. The CPU
that VM A's vcpu thread runs on, the CPU its vhost thread in the kernel
runs on, the CPU VM B's vhost thread runs on and finally the CPU VM B's
vcpu thread runs on.

It is possible to change the vhost implementation in the kernel to
handle packet transmission to local VMs in a single thread, but it is
rather hard. I have a hacky patch that implements that (that
unfortunately I cannot make public :( ) and it improves latency and CPU
utlization. I would suppose a userspace implementation of this is way
simpler and still give most of the performance benefits. It also removes
the virtio implementation in the kernel (vhost) from the trusted
computing base of other stuff in the system.

IMHO implementing device emulation in the kernel is plain wrong from a
security perspective.

Julian