On Tue, Dec 06, 2022 at 07:19:40AM +0100, Christoph Hellwig wrote: > On Tue, Dec 06, 2022 at 01:58:12PM +0800, Lei Rao wrote: > > The new function nvme_submit_vf_cmd() helps the host VF driver to issue > > VF admin commands. It's helpful in some cases that the host NVMe driver > > does not control VF's admin queue. For example, in the virtualization > > device pass-through case, the VF controller's admin queue is governed > > by the Guest NVMe driver. Host VF driver relies on PF device's admin > > queue to control VF devices like vendor-specific live migration commands. > > WTF are you even smoking when you think this would be acceptable? Not speaking to NVMe - but this driver is clearly copying mlx5's live migration driver, almost completely - including this basic function. So, to explain why mlx5 works this way.. The VFIO approach is to fully assign an entire VF to the guest OS. The entire VF assignment means every MMIO register *and all the DMA* of the VF is owned by the guest operating system. mlx5 needs to transfer hundreds of megabytes to gigabytes of in-device state to perform a migration. So, we must be able to use DMA to transfer the data. However, the VM exclusively controls the DMA of the VF. The iommu_domain of the VF belongs to the guest VM through VFIO, and we simply cannot mutate it. Not only should not, but physically can not, ie when IOMMU nested translation is in use and the IO page tables are in guest VM memory. So the VF cannot be used to control the migration, or transfer the migration data. This leaves only the PF. Thus, mxl5 has the same sort of design where the VF VFIO driver reaches into the PF kernel driver and asks the PF driver to perform some commands targeting the PF's own VFs. The DMA is then done using the RID of the PF, and reaches the kernel owned iommu_domain of the PF. This way the entire operation is secure aginst meddling by the guest. We can contrast this with the hisilicon live migration driver that does not use the PF for control. Instead it has a very small state that the migration driver simply reads out of registers. The VF has a page of registers that control pause/go of the queues and the VFIO varient driver denies access to this page from the guest VM so that the kernel VFIO driver has reliable control over the VF. Without involving PASID this is broadly the only two choices for doing SRIOV live migration, AFAIK. Jason
