[multicast] viona CTRL_RX/CTRL_MAC receive filtering + softnpu egress lock scoping + dep updates

.github/buildomat/jobs/check-headers.sh

@@ -18,11 +18,13 @@ set -e
 
 GATE_REF="$(./tools/check_headers gate_ref)"
 
-# TODO: `--branch` is overly restrictive, but it's what we've got. In git 2.49
-# the --revision flag was added to `git-clone`, and can clone an arbitrary
-# revision, which is more appropriate here. We might be tracking an arbitrary
-# commit with some changes in illumos-gate that isn't yet merged, after all.
-git clone --depth 1 --branch "$GATE_REF" \
-	https://code.oxide.computer/illumos-gate ./gate_src
+# `git clone --branch` only accepts branches and tags, but GATE_REF may be an
+# arbitrary ref (for example, a Gerrit change ref for an illumos-gate change
+# that has not yet merged). An init-and-fetch handles any ref the remote
+# advertises.
+git init ./gate_src
+git -C ./gate_src fetch --depth 1 \
+	https://code.oxide.computer/illumos-gate "$GATE_REF"
+git -C ./gate_src checkout --detach FETCH_HEAD
 
 ./tools/check_headers run ./gate_src

Cargo.toml

@@ -78,7 +78,7 @@ dlpi = { git = "https://github.com/oxidecomputer/dlpi-sys", branch = "main" }
 ispf = { git = "https://github.com/oxidecomputer/ispf" }
 libloading = "0.7"
 p9ds = { git = "https://github.com/oxidecomputer/p9fs" }
-softnpu = { git = "https://github.com/oxidecomputer/softnpu" }
+softnpu = { git = "https://github.com/oxidecomputer/softnpu", branch = "zl/multicast" }
 
 # Omicron-related
 internal-dns-resolver = { git = "https://github.com/oxidecomputer/omicron", rev = "5fd53a9c9ff2b0e47bfef3fe842b7516877b0162" }
@@ -149,7 +149,7 @@ newtype-uuid = { version = "1.0.1", features = [ "v4" ] }
 # "feature" for `utsname`, "poll" for `PollFlags`
 nix = { version = "0.31", features = [ "feature", "poll" ] }
 owo-colors = "4"
-oxide-tokio-rt = "0.1.2"
+oxide-tokio-rt = "0.1.4"
 paste = "1.0.15"
 pin-project-lite = "0.2.13"
 proc-macro2 = "1.0"

crates/viona-api/src/ffi.rs

@@ -39,6 +39,7 @@ pub const VNA_IOC_GET_MTU: i32 = vna_ioc(0x27);
 pub const VNA_IOC_SET_MTU: i32 = vna_ioc(0x28);
 pub const VNA_IOC_SET_NOTIFY_MMIO: i32 = vna_ioc(0x29);
 pub const VNA_IOC_INTR_POLL_MQ: i32 = vna_ioc(0x2a);
+pub const VNA_IOC_SET_MAC_FILTERS: i32 = vna_ioc(0x2b);
 
 /// VirtIO 1.2 queue pair support.
 pub const VNA_IOC_GET_PAIRS: i32 = vna_ioc(0x30);
@@ -135,6 +136,49 @@ pub const VIONA_PROMISC_ALL: i32 = 2;
 #[cfg(feature = "falcon")]
 pub const VIONA_PROMISC_ALL_VLAN: i32 = 3;
 
+/// Number of bytes in a filterable MAC address.
+pub const VIONA_MAC_FILTER_ADDRL: usize = 6;
+
+/// Maximum number of unicast MAC address filters accepted by viona.
+///
+/// No cross-device convention exists for a separate unicast table. QEMU
+/// shares one 64-entry table across both address classes (see
+/// [`VIONA_MAX_MCAST_FILTERS`]). Half the multicast table is generous for
+/// entries that are rejected unless they match the primary MAC.
+pub const VIONA_MAX_UNICAST_FILTERS: usize = 32;
+
+/// Maximum number of multicast MAC address filters accepted by viona.
+///
+/// Matches the 64-entry table convention of other virtio-net devices, per
+/// QEMU's [`MAC_TABLE_ENTRIES`].
+///
+/// [`MAC_TABLE_ENTRIES`]: https://github.com/qemu/qemu/blob/f893c46c3931b3684d235d221bf8b7844ddbf1d7/include/hw/virtio/virtio-net.h
+pub const VIONA_MAX_MCAST_FILTERS: usize = 64;
+
+/// Complete unicast and multicast MAC filter tables, replacing any tables
+/// previously installed on the link.  Counts of zero clear all filters.
+///
+/// Viona installs only multicast filters on the underlying MAC client.  The
+/// unicast table exists for shape parity with `VIRTIO_NET_CTRL_MAC_TABLE_SET`,
+/// and entries other than the primary MAC of the link are rejected.
+#[repr(C)]
+pub struct vioc_mac_filters {
+    pub vmf_nucast: u32,
+    pub vmf_nmcast: u32,
+    pub vmf_ucast: [[u8; VIONA_MAC_FILTER_ADDRL]; VIONA_MAX_UNICAST_FILTERS],
+    pub vmf_mcast: [[u8; VIONA_MAC_FILTER_ADDRL]; VIONA_MAX_MCAST_FILTERS],
+}
+impl Default for vioc_mac_filters {
+    fn default() -> Self {
+        Self {
+            vmf_nucast: 0,
+            vmf_nmcast: 0,
+            vmf_ucast: [[0; VIONA_MAC_FILTER_ADDRL]; VIONA_MAX_UNICAST_FILTERS],
+            vmf_mcast: [[0; VIONA_MAC_FILTER_ADDRL]; VIONA_MAX_MCAST_FILTERS],
+        }
+    }
+}
+
 #[repr(C)]
 #[derive(Default)]
 pub struct vioc_get_params {
@@ -154,7 +198,7 @@ pub struct vioc_set_params {
 /// This is the viona interface version which viona_api expects to operate
 /// against.  All constants and structs defined by the crate are done so in
 /// terms of that specific version.
-pub const VIONA_CURRENT_INTERFACE_VERSION: u32 = 6;
+pub const VIONA_CURRENT_INTERFACE_VERSION: u32 = 7;
 
 /// Maximum size of packed nvlists used in viona parameter ioctls
 pub const VIONA_MAX_PARAM_NVLIST_SZ: usize = 4096;

crates/viona-api/src/lib.rs

@@ -197,6 +197,10 @@ fn minor(meta: &std::fs::Metadata) -> u32 {
 #[repr(u32)]
 #[derive(Copy, Clone)]
 pub enum ApiVersion {
+    /// Adds support for installing MAC address filter tables on the
+    /// underlying MAC client.
+    V7 = 7,
+
     /// Adds multi-queue support and change the data structure for per-queue
     /// interrupt polling to a compact bitmap.
     V6 = 6,
@@ -218,7 +222,7 @@ pub enum ApiVersion {
 }
 impl ApiVersion {
     pub const fn current() -> Self {
-        Self::V6
+        Self::V7
     }
 }
 impl PartialEq<ApiVersion> for u32 {

lib/propolis/src/hw/virtio/mod.rs

@@ -227,6 +227,16 @@ pub trait VirtioDevice: Send + Sync + 'static + Lifecycle {
     ) -> Result<(), ()> {
         Ok(())
     }
+
+    /// Notification that the virtio portion of the device has been reset.
+    ///
+    /// This fires for guest-initiated status resets as well as full device
+    /// resets, after the generic virtio state and virtqueues have been reset.
+    ///
+    /// Devices should use this to restore any state tied to feature
+    /// negotiation, since the next driver may negotiate a different feature
+    /// set.
+    fn device_reset(&self) {}
 }
 
 pub trait VirtioIntr: Send + 'static {

lib/propolis/src/hw/virtio/pci.rs

@@ -1190,6 +1190,10 @@ impl PciVirtioState {
         self.reset_queues_locked(dev, &mut state);
         state.reset();
         let _ = self.isr_state.read_clear();
+        // Release the state lock before calling into the device so that its
+        // reset handling may query generic virtio state.
+        drop(state);
+        dev.device_reset();
     }
 
     pub fn reset<D>(&self, dev: &D)

lib/propolis/src/hw/virtio/softnpu.rs

@@ -348,27 +348,16 @@ impl PciVirtioSoftNpuPort {
 
             let pkt = packet_in::new(&frame[..n]);
 
-            let mut pipeline = match self.pipeline.lock() {
-                Ok(pipe) => pipe,
-                Err(e) => {
-                    error!(self.log, "failed to lock pipeline: {}", e);
-                    break;
-                }
-            };
-            let pl: &mut Box<dyn Pipeline> = match &mut *pipeline {
-                Some(ref mut x) => &mut x.1,
-                None => {
-                    // This just means no P4 program has been set by the guest.
-                    break;
-                }
-            };
-
-            PacketHandler::process_guest_packet(
+            if PacketHandler::process_guest_packet(
                 pkt,
                 &self.data_handles,
-                pl,
+                &self.pipeline,
                 &self.log,
-            );
+            )
+            .is_err()
+            {
+                break;
+            }
         }
 
         if push_used {
@@ -446,6 +435,10 @@ impl VirtioDevice for PciVirtioSoftNpuPort {
     }
 }
 
+/// Error indicating the pipeline cannot process guest packets because no
+/// P4 program has been loaded by the guest.
+struct NoP4Program;
+
 struct PacketHandler {}
 
 impl PacketHandler {
@@ -504,21 +497,13 @@ impl PacketHandler {
             //
             // process packet with loaded P4 program
             //
-
-            // TODO pipeline should not need to be mutable for packet handling?
             let pkt = packet_in::new(&msg[..n]);
-            let mut p = pipeline.lock().unwrap();
-            let pl = match &mut *p {
-                Some(ref mut pl) => &mut pl.1,
-                None => continue, // no program is loaded
-            };
-
             Self::process_external_packet(
                 index + 1,
                 pkt,
                 &data_handles,
                 &virtio,
-                pl,
+                &pipeline,
                 &log,
             )
         }
@@ -531,12 +516,26 @@ impl PacketHandler {
         mut pkt: packet_in<'_>,
         data_handles: &Vec<dlpi::DlpiHandle>,
         virtio: &Arc<PortVirtioState>,
-        pipeline: &mut Box<dyn Pipeline>,
+        pipeline: &Mutex<Option<LoadedP4Program>>,
         log: &Logger,
     ) {
-        for (mut out_pkt, port) in
+        // We hold the pipeline lock only while the pipeline computes the
+        // egress set. Every port worker serializes on this lock, and the
+        // dlpi and virtio egress I/O can block. Holding the lock across
+        // that I/O stalls the other workers, which is especially costly
+        // for multicast where one input frame fans out to several ports.
+        // The egress packets borrow from `pkt` rather than the pipeline,
+        // so they remain valid after the lock is released.
+        let outputs = {
+            let mut guard = pipeline.lock().unwrap();
+            let pipeline = match &mut *guard {
+                Some(ref mut loaded) => &mut loaded.1,
+                None => return, // no program is loaded
+            };
             pipeline.process_packet(index as u16, &mut pkt)
-        {
+        };
+
+        for (mut out_pkt, port) in outputs {
             // packet is going to CPU port
             if port == 0 {
                 Self::send_packet_to_cpu_port(&mut out_pkt, virtio, &log);
@@ -555,20 +554,34 @@ impl PacketHandler {
 
     /// Run a packet coming into the ASIC from the guest pci port through the
     /// loaded pipeline and forward it on to its destination.
+    ///
+    /// Errors indicate the pipeline cannot process packets, and the caller
+    /// should stop reading frames.
     fn process_guest_packet(
         mut pkt: packet_in<'_>,
         data_handles: &Vec<dlpi::DlpiHandle>,
-        pipeline: &mut Box<dyn Pipeline>,
+        pipeline: &Mutex<Option<LoadedP4Program>>,
         log: &Logger,
-    ) {
-        for (mut out_pkt, port) in pipeline.process_packet(0, &mut pkt) {
+    ) -> std::result::Result<(), NoP4Program> {
+        // We hold the pipeline lock only for pipeline processing, not the
+        // egress I/O (see `process_external_packet` for rationale).
+        let outputs = {
+            let mut guard = pipeline.lock().unwrap();
+            let pipeline = match &mut *guard {
+                Some(ref mut loaded) => &mut loaded.1,
+                None => return Err(NoP4Program),
+            };
+            pipeline.process_packet(0, &mut pkt)
+        };
+
+        for (mut out_pkt, port) in outputs {
             if port == 0 {
                 // no looping packets back to the guest
-                return;
+                return Ok(());
             }
             if port == SOFTNPU_CPU_AUX_PORT {
                 // we are not currently emulating this port type
-                return;
+                return Ok(());
             }
             Self::send_packet_to_ext_port(
                 &mut out_pkt,
@@ -577,6 +590,7 @@ impl PacketHandler {
                 &log,
             );
         }
+        Ok(())
     }
 
     /// Send a packet out an external port using dlpi.