xref: /openbmc/qemu/net/vhost-vdpa.c (revision 6188d78a19894ac8f2bf9484d48a5235a529d3b7)
1 /*
2  * vhost-vdpa.c
3  *
4  * Copyright(c) 2017-2018 Intel Corporation.
5  * Copyright(c) 2020 Red Hat, Inc.
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or later.
8  * See the COPYING file in the top-level directory.
9  *
10  */
11 
12 #include "qemu/osdep.h"
13 #include "clients.h"
14 #include "hw/virtio/virtio-net.h"
15 #include "net/vhost_net.h"
16 #include "net/vhost-vdpa.h"
17 #include "hw/virtio/vhost-vdpa.h"
18 #include "qemu/config-file.h"
19 #include "qemu/error-report.h"
20 #include "qemu/log.h"
21 #include "qemu/memalign.h"
22 #include "qemu/option.h"
23 #include "qapi/error.h"
24 #include <linux/vhost.h>
25 #include <sys/ioctl.h>
26 #include <err.h>
27 #include "standard-headers/linux/virtio_net.h"
28 #include "monitor/monitor.h"
29 #include "hw/virtio/vhost.h"
30 
31 /* Todo:need to add the multiqueue support here */
32 typedef struct VhostVDPAState {
33     NetClientState nc;
34     struct vhost_vdpa vhost_vdpa;
35     VHostNetState *vhost_net;
36 
37     /* Control commands shadow buffers */
38     void *cvq_cmd_out_buffer;
39     virtio_net_ctrl_ack *status;
40 
41     /* The device always have SVQ enabled */
42     bool always_svq;
43     bool started;
44 } VhostVDPAState;
45 
46 const int vdpa_feature_bits[] = {
47     VIRTIO_F_NOTIFY_ON_EMPTY,
48     VIRTIO_RING_F_INDIRECT_DESC,
49     VIRTIO_RING_F_EVENT_IDX,
50     VIRTIO_F_ANY_LAYOUT,
51     VIRTIO_F_VERSION_1,
52     VIRTIO_NET_F_CSUM,
53     VIRTIO_NET_F_GUEST_CSUM,
54     VIRTIO_NET_F_GSO,
55     VIRTIO_NET_F_GUEST_TSO4,
56     VIRTIO_NET_F_GUEST_TSO6,
57     VIRTIO_NET_F_GUEST_ECN,
58     VIRTIO_NET_F_GUEST_UFO,
59     VIRTIO_NET_F_HOST_TSO4,
60     VIRTIO_NET_F_HOST_TSO6,
61     VIRTIO_NET_F_HOST_ECN,
62     VIRTIO_NET_F_HOST_UFO,
63     VIRTIO_NET_F_MRG_RXBUF,
64     VIRTIO_NET_F_MTU,
65     VIRTIO_NET_F_CTRL_RX,
66     VIRTIO_NET_F_CTRL_RX_EXTRA,
67     VIRTIO_NET_F_CTRL_VLAN,
68     VIRTIO_NET_F_CTRL_MAC_ADDR,
69     VIRTIO_NET_F_RSS,
70     VIRTIO_NET_F_MQ,
71     VIRTIO_NET_F_CTRL_VQ,
72     VIRTIO_F_IOMMU_PLATFORM,
73     VIRTIO_F_RING_PACKED,
74     VIRTIO_F_RING_RESET,
75     VIRTIO_NET_F_RSS,
76     VIRTIO_NET_F_HASH_REPORT,
77     VIRTIO_NET_F_GUEST_ANNOUNCE,
78     VIRTIO_NET_F_STATUS,
79     VHOST_INVALID_FEATURE_BIT
80 };
81 
82 /** Supported device specific feature bits with SVQ */
83 static const uint64_t vdpa_svq_device_features =
84     BIT_ULL(VIRTIO_NET_F_CSUM) |
85     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
86     BIT_ULL(VIRTIO_NET_F_MTU) |
87     BIT_ULL(VIRTIO_NET_F_MAC) |
88     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |
89     BIT_ULL(VIRTIO_NET_F_GUEST_TSO6) |
90     BIT_ULL(VIRTIO_NET_F_GUEST_ECN) |
91     BIT_ULL(VIRTIO_NET_F_GUEST_UFO) |
92     BIT_ULL(VIRTIO_NET_F_HOST_TSO4) |
93     BIT_ULL(VIRTIO_NET_F_HOST_TSO6) |
94     BIT_ULL(VIRTIO_NET_F_HOST_ECN) |
95     BIT_ULL(VIRTIO_NET_F_HOST_UFO) |
96     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
97     BIT_ULL(VIRTIO_NET_F_STATUS) |
98     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
99     BIT_ULL(VIRTIO_NET_F_MQ) |
100     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
101     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |
102     BIT_ULL(VIRTIO_NET_F_RSC_EXT) |
103     BIT_ULL(VIRTIO_NET_F_STANDBY);
104 
105 VHostNetState *vhost_vdpa_get_vhost_net(NetClientState *nc)
106 {
107     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
108     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
109     return s->vhost_net;
110 }
111 
112 static bool vhost_vdpa_net_valid_svq_features(uint64_t features, Error **errp)
113 {
114     uint64_t invalid_dev_features =
115         features & ~vdpa_svq_device_features &
116         /* Transport are all accepted at this point */
117         ~MAKE_64BIT_MASK(VIRTIO_TRANSPORT_F_START,
118                          VIRTIO_TRANSPORT_F_END - VIRTIO_TRANSPORT_F_START);
119 
120     if (invalid_dev_features) {
121         error_setg(errp, "vdpa svq does not work with features 0x%" PRIx64,
122                    invalid_dev_features);
123         return false;
124     }
125 
126     return vhost_svq_valid_features(features, errp);
127 }
128 
129 static int vhost_vdpa_net_check_device_id(struct vhost_net *net)
130 {
131     uint32_t device_id;
132     int ret;
133     struct vhost_dev *hdev;
134 
135     hdev = (struct vhost_dev *)&net->dev;
136     ret = hdev->vhost_ops->vhost_get_device_id(hdev, &device_id);
137     if (device_id != VIRTIO_ID_NET) {
138         return -ENOTSUP;
139     }
140     return ret;
141 }
142 
143 static int vhost_vdpa_add(NetClientState *ncs, void *be,
144                           int queue_pair_index, int nvqs)
145 {
146     VhostNetOptions options;
147     struct vhost_net *net = NULL;
148     VhostVDPAState *s;
149     int ret;
150 
151     options.backend_type = VHOST_BACKEND_TYPE_VDPA;
152     assert(ncs->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
153     s = DO_UPCAST(VhostVDPAState, nc, ncs);
154     options.net_backend = ncs;
155     options.opaque      = be;
156     options.busyloop_timeout = 0;
157     options.nvqs = nvqs;
158 
159     net = vhost_net_init(&options);
160     if (!net) {
161         error_report("failed to init vhost_net for queue");
162         goto err_init;
163     }
164     s->vhost_net = net;
165     ret = vhost_vdpa_net_check_device_id(net);
166     if (ret) {
167         goto err_check;
168     }
169     return 0;
170 err_check:
171     vhost_net_cleanup(net);
172     g_free(net);
173 err_init:
174     return -1;
175 }
176 
177 static void vhost_vdpa_cleanup(NetClientState *nc)
178 {
179     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
180     struct vhost_dev *dev = &s->vhost_net->dev;
181 
182     qemu_vfree(s->cvq_cmd_out_buffer);
183     qemu_vfree(s->status);
184     if (dev->vq_index + dev->nvqs == dev->vq_index_end) {
185         g_clear_pointer(&s->vhost_vdpa.iova_tree, vhost_iova_tree_delete);
186     }
187     if (s->vhost_net) {
188         vhost_net_cleanup(s->vhost_net);
189         g_free(s->vhost_net);
190         s->vhost_net = NULL;
191     }
192      if (s->vhost_vdpa.device_fd >= 0) {
193         qemu_close(s->vhost_vdpa.device_fd);
194         s->vhost_vdpa.device_fd = -1;
195     }
196 }
197 
198 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
199 {
200     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
201 
202     return true;
203 }
204 
205 static bool vhost_vdpa_has_ufo(NetClientState *nc)
206 {
207     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
208     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
209     uint64_t features = 0;
210     features |= (1ULL << VIRTIO_NET_F_HOST_UFO);
211     features = vhost_net_get_features(s->vhost_net, features);
212     return !!(features & (1ULL << VIRTIO_NET_F_HOST_UFO));
213 
214 }
215 
216 static bool vhost_vdpa_check_peer_type(NetClientState *nc, ObjectClass *oc,
217                                        Error **errp)
218 {
219     const char *driver = object_class_get_name(oc);
220 
221     if (!g_str_has_prefix(driver, "virtio-net-")) {
222         error_setg(errp, "vhost-vdpa requires frontend driver virtio-net-*");
223         return false;
224     }
225 
226     return true;
227 }
228 
229 /** Dummy receive in case qemu falls back to userland tap networking */
230 static ssize_t vhost_vdpa_receive(NetClientState *nc, const uint8_t *buf,
231                                   size_t size)
232 {
233     return size;
234 }
235 
236 static NetClientInfo net_vhost_vdpa_info = {
237         .type = NET_CLIENT_DRIVER_VHOST_VDPA,
238         .size = sizeof(VhostVDPAState),
239         .receive = vhost_vdpa_receive,
240         .cleanup = vhost_vdpa_cleanup,
241         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
242         .has_ufo = vhost_vdpa_has_ufo,
243         .check_peer_type = vhost_vdpa_check_peer_type,
244 };
245 
246 static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
247 {
248     VhostIOVATree *tree = v->iova_tree;
249     DMAMap needle = {
250         /*
251          * No need to specify size or to look for more translations since
252          * this contiguous chunk was allocated by us.
253          */
254         .translated_addr = (hwaddr)(uintptr_t)addr,
255     };
256     const DMAMap *map = vhost_iova_tree_find_iova(tree, &needle);
257     int r;
258 
259     if (unlikely(!map)) {
260         error_report("Cannot locate expected map");
261         return;
262     }
263 
264     r = vhost_vdpa_dma_unmap(v, v->address_space_id, map->iova, map->size + 1);
265     if (unlikely(r != 0)) {
266         error_report("Device cannot unmap: %s(%d)", g_strerror(r), r);
267     }
268 
269     vhost_iova_tree_remove(tree, *map);
270 }
271 
272 static size_t vhost_vdpa_net_cvq_cmd_len(void)
273 {
274     /*
275      * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
276      * In buffer is always 1 byte, so it should fit here
277      */
278     return sizeof(struct virtio_net_ctrl_hdr) +
279            2 * sizeof(struct virtio_net_ctrl_mac) +
280            MAC_TABLE_ENTRIES * ETH_ALEN;
281 }
282 
283 static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
284 {
285     return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
286 }
287 
288 /** Map CVQ buffer. */
289 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
290                                   bool write)
291 {
292     DMAMap map = {};
293     int r;
294 
295     map.translated_addr = (hwaddr)(uintptr_t)buf;
296     map.size = size - 1;
297     map.perm = write ? IOMMU_RW : IOMMU_RO,
298     r = vhost_iova_tree_map_alloc(v->iova_tree, &map);
299     if (unlikely(r != IOVA_OK)) {
300         error_report("Cannot map injected element");
301         return r;
302     }
303 
304     r = vhost_vdpa_dma_map(v, v->address_space_id, map.iova,
305                            vhost_vdpa_net_cvq_cmd_page_len(), buf, !write);
306     if (unlikely(r < 0)) {
307         goto dma_map_err;
308     }
309 
310     return 0;
311 
312 dma_map_err:
313     vhost_iova_tree_remove(v->iova_tree, map);
314     return r;
315 }
316 
317 static int vhost_vdpa_net_cvq_start(NetClientState *nc)
318 {
319     VhostVDPAState *s;
320     int r;
321 
322     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
323 
324     s = DO_UPCAST(VhostVDPAState, nc, nc);
325     if (!s->vhost_vdpa.shadow_vqs_enabled) {
326         return 0;
327     }
328 
329     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
330                                vhost_vdpa_net_cvq_cmd_page_len(), false);
331     if (unlikely(r < 0)) {
332         return r;
333     }
334 
335     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->status,
336                                vhost_vdpa_net_cvq_cmd_page_len(), true);
337     if (unlikely(r < 0)) {
338         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
339     }
340 
341     return r;
342 }
343 
344 static void vhost_vdpa_net_cvq_stop(NetClientState *nc)
345 {
346     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
347 
348     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
349 
350     if (s->vhost_vdpa.shadow_vqs_enabled) {
351         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
352         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->status);
353     }
354 }
355 
356 static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s, size_t out_len,
357                                       size_t in_len)
358 {
359     /* Buffers for the device */
360     const struct iovec out = {
361         .iov_base = s->cvq_cmd_out_buffer,
362         .iov_len = out_len,
363     };
364     const struct iovec in = {
365         .iov_base = s->status,
366         .iov_len = sizeof(virtio_net_ctrl_ack),
367     };
368     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
369     int r;
370 
371     r = vhost_svq_add(svq, &out, 1, &in, 1, NULL);
372     if (unlikely(r != 0)) {
373         if (unlikely(r == -ENOSPC)) {
374             qemu_log_mask(LOG_GUEST_ERROR, "%s: No space on device queue\n",
375                           __func__);
376         }
377         return r;
378     }
379 
380     /*
381      * We can poll here since we've had BQL from the time we sent the
382      * descriptor. Also, we need to take the answer before SVQ pulls by itself,
383      * when BQL is released
384      */
385     return vhost_svq_poll(svq);
386 }
387 
388 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s, uint8_t class,
389                                        uint8_t cmd, const void *data,
390                                        size_t data_size)
391 {
392     const struct virtio_net_ctrl_hdr ctrl = {
393         .class = class,
394         .cmd = cmd,
395     };
396 
397     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
398 
399     memcpy(s->cvq_cmd_out_buffer, &ctrl, sizeof(ctrl));
400     memcpy(s->cvq_cmd_out_buffer + sizeof(ctrl), data, data_size);
401 
402     return vhost_vdpa_net_cvq_add(s, sizeof(ctrl) + data_size,
403                                   sizeof(virtio_net_ctrl_ack));
404 }
405 
406 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n)
407 {
408     uint64_t features = n->parent_obj.guest_features;
409     if (features & BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR)) {
410         ssize_t dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MAC,
411                                                   VIRTIO_NET_CTRL_MAC_ADDR_SET,
412                                                   n->mac, sizeof(n->mac));
413         if (unlikely(dev_written < 0)) {
414             return dev_written;
415         }
416 
417         return *s->status != VIRTIO_NET_OK;
418     }
419 
420     return 0;
421 }
422 
423 static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
424                                   const VirtIONet *n)
425 {
426     struct virtio_net_ctrl_mq mq;
427     uint64_t features = n->parent_obj.guest_features;
428     ssize_t dev_written;
429 
430     if (!(features & BIT_ULL(VIRTIO_NET_F_MQ))) {
431         return 0;
432     }
433 
434     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
435     dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MQ,
436                                           VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &mq,
437                                           sizeof(mq));
438     if (unlikely(dev_written < 0)) {
439         return dev_written;
440     }
441 
442     return *s->status != VIRTIO_NET_OK;
443 }
444 
445 static int vhost_vdpa_net_load(NetClientState *nc)
446 {
447     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
448     struct vhost_vdpa *v = &s->vhost_vdpa;
449     const VirtIONet *n;
450     int r;
451 
452     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
453 
454     if (!v->shadow_vqs_enabled) {
455         return 0;
456     }
457 
458     n = VIRTIO_NET(v->dev->vdev);
459     r = vhost_vdpa_net_load_mac(s, n);
460     if (unlikely(r < 0)) {
461         return r;
462     }
463     r = vhost_vdpa_net_load_mq(s, n);
464     if (unlikely(r)) {
465         return r;
466     }
467 
468     return 0;
469 }
470 
471 static NetClientInfo net_vhost_vdpa_cvq_info = {
472     .type = NET_CLIENT_DRIVER_VHOST_VDPA,
473     .size = sizeof(VhostVDPAState),
474     .receive = vhost_vdpa_receive,
475     .start = vhost_vdpa_net_cvq_start,
476     .load = vhost_vdpa_net_load,
477     .stop = vhost_vdpa_net_cvq_stop,
478     .cleanup = vhost_vdpa_cleanup,
479     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
480     .has_ufo = vhost_vdpa_has_ufo,
481     .check_peer_type = vhost_vdpa_check_peer_type,
482 };
483 
484 /**
485  * Validate and copy control virtqueue commands.
486  *
487  * Following QEMU guidelines, we offer a copy of the buffers to the device to
488  * prevent TOCTOU bugs.
489  */
490 static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
491                                             VirtQueueElement *elem,
492                                             void *opaque)
493 {
494     VhostVDPAState *s = opaque;
495     size_t in_len;
496     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
497     /* Out buffer sent to both the vdpa device and the device model */
498     struct iovec out = {
499         .iov_base = s->cvq_cmd_out_buffer,
500     };
501     /* in buffer used for device model */
502     const struct iovec in = {
503         .iov_base = &status,
504         .iov_len = sizeof(status),
505     };
506     ssize_t dev_written = -EINVAL;
507 
508     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
509                              s->cvq_cmd_out_buffer,
510                              vhost_vdpa_net_cvq_cmd_len());
511     dev_written = vhost_vdpa_net_cvq_add(s, out.iov_len, sizeof(status));
512     if (unlikely(dev_written < 0)) {
513         goto out;
514     }
515 
516     if (unlikely(dev_written < sizeof(status))) {
517         error_report("Insufficient written data (%zu)", dev_written);
518         goto out;
519     }
520 
521     if (*s->status != VIRTIO_NET_OK) {
522         return VIRTIO_NET_ERR;
523     }
524 
525     status = VIRTIO_NET_ERR;
526     virtio_net_handle_ctrl_iov(svq->vdev, &in, 1, &out, 1);
527     if (status != VIRTIO_NET_OK) {
528         error_report("Bad CVQ processing in model");
529     }
530 
531 out:
532     in_len = iov_from_buf(elem->in_sg, elem->in_num, 0, &status,
533                           sizeof(status));
534     if (unlikely(in_len < sizeof(status))) {
535         error_report("Bad device CVQ written length");
536     }
537     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
538     g_free(elem);
539     return dev_written < 0 ? dev_written : 0;
540 }
541 
542 static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
543     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
544 };
545 
546 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
547                                        const char *device,
548                                        const char *name,
549                                        int vdpa_device_fd,
550                                        int queue_pair_index,
551                                        int nvqs,
552                                        bool is_datapath,
553                                        bool svq,
554                                        struct vhost_vdpa_iova_range iova_range,
555                                        VhostIOVATree *iova_tree)
556 {
557     NetClientState *nc = NULL;
558     VhostVDPAState *s;
559     int ret = 0;
560     assert(name);
561     if (is_datapath) {
562         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
563                                  name);
564     } else {
565         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
566                                          device, name);
567     }
568     qemu_set_info_str(nc, TYPE_VHOST_VDPA);
569     s = DO_UPCAST(VhostVDPAState, nc, nc);
570 
571     s->vhost_vdpa.device_fd = vdpa_device_fd;
572     s->vhost_vdpa.index = queue_pair_index;
573     s->always_svq = svq;
574     s->vhost_vdpa.shadow_vqs_enabled = svq;
575     s->vhost_vdpa.iova_range = iova_range;
576     s->vhost_vdpa.shadow_data = svq;
577     s->vhost_vdpa.iova_tree = iova_tree;
578     if (!is_datapath) {
579         s->cvq_cmd_out_buffer = qemu_memalign(qemu_real_host_page_size(),
580                                             vhost_vdpa_net_cvq_cmd_page_len());
581         memset(s->cvq_cmd_out_buffer, 0, vhost_vdpa_net_cvq_cmd_page_len());
582         s->status = qemu_memalign(qemu_real_host_page_size(),
583                                   vhost_vdpa_net_cvq_cmd_page_len());
584         memset(s->status, 0, vhost_vdpa_net_cvq_cmd_page_len());
585 
586         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
587         s->vhost_vdpa.shadow_vq_ops_opaque = s;
588     }
589     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
590     if (ret) {
591         qemu_del_net_client(nc);
592         return NULL;
593     }
594     return nc;
595 }
596 
597 static int vhost_vdpa_get_iova_range(int fd,
598                                      struct vhost_vdpa_iova_range *iova_range)
599 {
600     int ret = ioctl(fd, VHOST_VDPA_GET_IOVA_RANGE, iova_range);
601 
602     return ret < 0 ? -errno : 0;
603 }
604 
605 static int vhost_vdpa_get_features(int fd, uint64_t *features, Error **errp)
606 {
607     int ret = ioctl(fd, VHOST_GET_FEATURES, features);
608     if (unlikely(ret < 0)) {
609         error_setg_errno(errp, errno,
610                          "Fail to query features from vhost-vDPA device");
611     }
612     return ret;
613 }
614 
615 static int vhost_vdpa_get_max_queue_pairs(int fd, uint64_t features,
616                                           int *has_cvq, Error **errp)
617 {
618     unsigned long config_size = offsetof(struct vhost_vdpa_config, buf);
619     g_autofree struct vhost_vdpa_config *config = NULL;
620     __virtio16 *max_queue_pairs;
621     int ret;
622 
623     if (features & (1 << VIRTIO_NET_F_CTRL_VQ)) {
624         *has_cvq = 1;
625     } else {
626         *has_cvq = 0;
627     }
628 
629     if (features & (1 << VIRTIO_NET_F_MQ)) {
630         config = g_malloc0(config_size + sizeof(*max_queue_pairs));
631         config->off = offsetof(struct virtio_net_config, max_virtqueue_pairs);
632         config->len = sizeof(*max_queue_pairs);
633 
634         ret = ioctl(fd, VHOST_VDPA_GET_CONFIG, config);
635         if (ret) {
636             error_setg(errp, "Fail to get config from vhost-vDPA device");
637             return -ret;
638         }
639 
640         max_queue_pairs = (__virtio16 *)&config->buf;
641 
642         return lduw_le_p(max_queue_pairs);
643     }
644 
645     return 1;
646 }
647 
648 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
649                         NetClientState *peer, Error **errp)
650 {
651     const NetdevVhostVDPAOptions *opts;
652     uint64_t features;
653     int vdpa_device_fd;
654     g_autofree NetClientState **ncs = NULL;
655     g_autoptr(VhostIOVATree) iova_tree = NULL;
656     struct vhost_vdpa_iova_range iova_range;
657     NetClientState *nc;
658     int queue_pairs, r, i = 0, has_cvq = 0;
659 
660     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
661     opts = &netdev->u.vhost_vdpa;
662     if (!opts->vhostdev && !opts->vhostfd) {
663         error_setg(errp,
664                    "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
665         return -1;
666     }
667 
668     if (opts->vhostdev && opts->vhostfd) {
669         error_setg(errp,
670                    "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
671         return -1;
672     }
673 
674     if (opts->vhostdev) {
675         vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
676         if (vdpa_device_fd == -1) {
677             return -errno;
678         }
679     } else {
680         /* has_vhostfd */
681         vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
682         if (vdpa_device_fd == -1) {
683             error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
684             return -1;
685         }
686     }
687 
688     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
689     if (unlikely(r < 0)) {
690         goto err;
691     }
692 
693     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
694                                                  &has_cvq, errp);
695     if (queue_pairs < 0) {
696         qemu_close(vdpa_device_fd);
697         return queue_pairs;
698     }
699 
700     vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
701     if (opts->x_svq) {
702         if (!vhost_vdpa_net_valid_svq_features(features, errp)) {
703             goto err_svq;
704         }
705 
706         iova_tree = vhost_iova_tree_new(iova_range.first, iova_range.last);
707     }
708 
709     ncs = g_malloc0(sizeof(*ncs) * queue_pairs);
710 
711     for (i = 0; i < queue_pairs; i++) {
712         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
713                                      vdpa_device_fd, i, 2, true, opts->x_svq,
714                                      iova_range, iova_tree);
715         if (!ncs[i])
716             goto err;
717     }
718 
719     if (has_cvq) {
720         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
721                                  vdpa_device_fd, i, 1, false,
722                                  opts->x_svq, iova_range, iova_tree);
723         if (!nc)
724             goto err;
725     }
726 
727     /* iova_tree ownership belongs to last NetClientState */
728     g_steal_pointer(&iova_tree);
729     return 0;
730 
731 err:
732     if (i) {
733         for (i--; i >= 0; i--) {
734             qemu_del_net_client(ncs[i]);
735         }
736     }
737 
738 err_svq:
739     qemu_close(vdpa_device_fd);
740 
741     return -1;
742 }
743