Re: Outline for VHOST_USER_PROTOCOL_F_VDPA

[Stefan Hajnoczi]

On Tue, Sep 29, 2020 at 06:04:34AM -0400, Michael S. Tsirkin wrote:
> On Tue, Sep 29, 2020 at 09:57:51AM +0100, Stefan Hajnoczi wrote:
> > On Tue, Sep 29, 2020 at 02:09:55AM -0400, Michael S. Tsirkin wrote:
> > > On Mon, Sep 28, 2020 at 10:25:37AM +0100, Stefan Hajnoczi wrote:
> > > > Why extend vhost-user with vDPA?
> > > > ================================
> > > > Reusing VIRTIO emulation code for vhost-user backends
> > > > -----------------------------------------------------
> > > > It is a common misconception that a vhost device is a VIRTIO device.
> > > > VIRTIO devices are defined in the VIRTIO specification and consist of a
> > > > configuration space, virtqueues, and a device lifecycle that includes
> > > > feature negotiation. A vhost device is a subset of the corresponding
> > > > VIRTIO device. The exact subset depends on the device type, and some
> > > > vhost devices are closer to the full functionality of their
> > > > corresponding VIRTIO device than others. The most well-known example is
> > > > that vhost-net devices have rx/tx virtqueues and but lack the virtio-net
> > > > control virtqueue. Also, the configuration space and device lifecycle
> > > > are only partially available to vhost devices.
> > > > 
> > > > This difference makes it impossible to use a VIRTIO device as a
> > > > vhost-user device and vice versa. There is an impedance mismatch and
> > > > missing functionality. That's a shame because existing VIRTIO device
> > > > emulation code is mature and duplicating it to provide vhost-user
> > > > backends creates additional work.
> > > 
> > > 
> > > The biggest issue facing vhost-user and absent in vdpa is
> > > backend disconnect handling. This is the reason control path
> > > is kept under QEMU control: we do not need any logic to
> > > restore control path data, and we can verify a new backend
> > > is consistent with old one.
> > 
> > I don't think using vhost-user with vDPA changes that. The VMM still
> > needs to emulate a virtio-pci/ccw/mmio device that the guest interfaces
> > with. If the device backend goes offline it's possible to restore that
> > state upon reconnection. What have I missed?
> 
> The need to maintain the state in a way that is robust
> against backend disconnects and can be restored.

QEMU is only bypassed for virtqueue accesses. Everything else still
goes through the virtio-pci emulation in QEMU (VIRTIO configuration
space, status register). vDPA doesn't change this.

Existing vhost-user messages can be kept if they are useful (e.g.
virtqueue state tracking). So I think the situation is no different than
with the existing vhost-user protocol.

> > Regarding reconnection in general, it currently seems like a partially
> > solved problem in vhost-user. There is the "Inflight I/O tracking"
> > mechanism in the spec and some wording about reconnecting the socket,
> > but in practice I wouldn't expect all device types, VMMs, or device
> > backends to actually support reconnection. This is an area where a
> > uniform solution would be very welcome too.
> 
> I'm not aware of big issues. What are they?

I think "Inflight I/O tracking" can only be used when request processing
is idempotent? In other words, it can only be used when submitting the
same request multiple times is safe.

A silly example where this recovery mechanism cannot be used is if a
device has a persistent counter that is incremented by the request. The
guest can't be sure that the counter will be incremented exactly once.

Another example: devices that support requests with compare-and-swap
semantics cannot use this mechanism. During recover the compare will
fail if the request was just completing when the backend crashed.

Do I understand the limitations of this mechanism correctly? It doesn't
seem general and I doubt it can be applied to all existing device types.

> > There was discussion about recovering state in muser. The original idea
> > was for the muser kernel module to host state that persists across
> > device backend restart. That way the device backend can go away
> > temporarily and resume without guest intervention.
> > 
> > Then when the vfio-user discussion started the idea morphed into simply
> > keeping a tmpfs file for each device instance (no special muser.ko
> > support needed anymore). This allows the device backend to resume
> > without losing state. In practice a programming framework is needed to
> > make this easy and safe to use but it boils down to a tmpfs mmap.
> > 
> > > > If there was a way to reuse existing VIRTIO device emulation code it
> > > > would be easier to move to a multi-process architecture in QEMU. Want to
> > > > run --netdev user,id=netdev0 --device virtio-net-pci,netdev=netdev0 in a
> > > > separate, sandboxed process? Easy, run it as a vhost-user-net device
> > > > instead of as virtio-net.
> > > 
> > > Given vhost-user is using a socket, and given there's an elaborate
> > > protocol due to need for backwards compatibility, it seems safer to
> > > have vhost-user interface in a separate process too.
> > 
> > Right, with vhost-user only the virtqueue processing is done in the
> > device backend. The VMM still has to do the virtio transport emulation
> > (pci, ccw, mmio) and vhost-user connection lifecycle, which is complex.
> 
> IIUC all vfio user does is add another protocol in the VMM,
> and move code out of VMM to backend.
> 
> Architecturally I don't see why it's safer.

It eliminates one layer of device emulation (virtio-pci). Fewer
registers to emulate means a smaller attack surface.

It's possible to take things further, maybe with the proposed ioregionfd
mechanism, where the VMM's KVM_RUN loop no longer handles MMIO/PIO
exits. A separate process can handle them. Maybe some platform devices
need CPU state access though.

BTW I think the goal of removing as much emulation from the VMM as
possible is interesting.

Did you have some other approach in mind to remove the PCI and
virtio-pci device from the VMM?

> Something like multi-process patches seems like a way to
> add defence in depth by having a process in the middle,
> outside both VMM and backend.

There is no third process in mpqemu. The VMM uses a UNIX domain socket
to communicate directly with the device backend. There is a PCI "proxy"
device in the VMM that does this communication when the guest accesses
registers. The device backend has a PCI "remote" host controller that a
PCIDevice instance is plugged into and the UNIX domain socket protocol
commands are translated into PCIDevice operations.

This is exactly the same as vfio-user. The only difference is that
vfio-user uses an existing set of commands, whereas mpqemu defines a new
protocol that will eventually need to provide equivalent functionality.

> > Going back to Marc-André's point, why don't we focus on vfio-user so the
> > entire device can be moved out of the VMM?
> > 
> > Stefan
> 
> The fact that vfio-user adds a kernel component is one issue.

vfio-user only needs a UNIX domain socket. The muser.ko kernel module
that was discussed after last KVM Forum is not used by vfio-user.

Stefan

signature.asc
Description: PGP signature