xref: /openbmc/qemu/net/vhost-vdpa.c (revision cd831ed5c4add8ed6ee980c3645b241cbef5130f)
1 /*
2  * vhost-vdpa.c
3  *
4  * Copyright(c) 2017-2018 Intel Corporation.
5  * Copyright(c) 2020 Red Hat, Inc.
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or later.
8  * See the COPYING file in the top-level directory.
9  *
10  */
11 
12 #include "qemu/osdep.h"
13 #include "clients.h"
14 #include "hw/virtio/virtio-net.h"
15 #include "net/vhost_net.h"
16 #include "net/vhost-vdpa.h"
17 #include "hw/virtio/vhost-vdpa.h"
18 #include "qemu/config-file.h"
19 #include "qemu/error-report.h"
20 #include "qemu/log.h"
21 #include "qemu/memalign.h"
22 #include "qemu/option.h"
23 #include "qapi/error.h"
24 #include <linux/vhost.h>
25 #include <sys/ioctl.h>
26 #include <err.h>
27 #include "standard-headers/linux/virtio_net.h"
28 #include "monitor/monitor.h"
29 #include "hw/virtio/vhost.h"
30 
31 /* Todo:need to add the multiqueue support here */
32 typedef struct VhostVDPAState {
33     NetClientState nc;
34     struct vhost_vdpa vhost_vdpa;
35     VHostNetState *vhost_net;
36 
37     /* Control commands shadow buffers */
38     void *cvq_cmd_out_buffer;
39     virtio_net_ctrl_ack *status;
40 
41     bool started;
42 } VhostVDPAState;
43 
44 const int vdpa_feature_bits[] = {
45     VIRTIO_F_NOTIFY_ON_EMPTY,
46     VIRTIO_RING_F_INDIRECT_DESC,
47     VIRTIO_RING_F_EVENT_IDX,
48     VIRTIO_F_ANY_LAYOUT,
49     VIRTIO_F_VERSION_1,
50     VIRTIO_NET_F_CSUM,
51     VIRTIO_NET_F_GUEST_CSUM,
52     VIRTIO_NET_F_GSO,
53     VIRTIO_NET_F_GUEST_TSO4,
54     VIRTIO_NET_F_GUEST_TSO6,
55     VIRTIO_NET_F_GUEST_ECN,
56     VIRTIO_NET_F_GUEST_UFO,
57     VIRTIO_NET_F_HOST_TSO4,
58     VIRTIO_NET_F_HOST_TSO6,
59     VIRTIO_NET_F_HOST_ECN,
60     VIRTIO_NET_F_HOST_UFO,
61     VIRTIO_NET_F_MRG_RXBUF,
62     VIRTIO_NET_F_MTU,
63     VIRTIO_NET_F_CTRL_RX,
64     VIRTIO_NET_F_CTRL_RX_EXTRA,
65     VIRTIO_NET_F_CTRL_VLAN,
66     VIRTIO_NET_F_CTRL_MAC_ADDR,
67     VIRTIO_NET_F_RSS,
68     VIRTIO_NET_F_MQ,
69     VIRTIO_NET_F_CTRL_VQ,
70     VIRTIO_F_IOMMU_PLATFORM,
71     VIRTIO_F_RING_PACKED,
72     VIRTIO_F_RING_RESET,
73     VIRTIO_NET_F_RSS,
74     VIRTIO_NET_F_HASH_REPORT,
75     VIRTIO_NET_F_GUEST_ANNOUNCE,
76     VIRTIO_NET_F_STATUS,
77     VHOST_INVALID_FEATURE_BIT
78 };
79 
80 /** Supported device specific feature bits with SVQ */
81 static const uint64_t vdpa_svq_device_features =
82     BIT_ULL(VIRTIO_NET_F_CSUM) |
83     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
84     BIT_ULL(VIRTIO_NET_F_MTU) |
85     BIT_ULL(VIRTIO_NET_F_MAC) |
86     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |
87     BIT_ULL(VIRTIO_NET_F_GUEST_TSO6) |
88     BIT_ULL(VIRTIO_NET_F_GUEST_ECN) |
89     BIT_ULL(VIRTIO_NET_F_GUEST_UFO) |
90     BIT_ULL(VIRTIO_NET_F_HOST_TSO4) |
91     BIT_ULL(VIRTIO_NET_F_HOST_TSO6) |
92     BIT_ULL(VIRTIO_NET_F_HOST_ECN) |
93     BIT_ULL(VIRTIO_NET_F_HOST_UFO) |
94     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
95     BIT_ULL(VIRTIO_NET_F_STATUS) |
96     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
97     BIT_ULL(VIRTIO_NET_F_MQ) |
98     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
99     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |
100     BIT_ULL(VIRTIO_NET_F_RSC_EXT) |
101     BIT_ULL(VIRTIO_NET_F_STANDBY);
102 
103 VHostNetState *vhost_vdpa_get_vhost_net(NetClientState *nc)
104 {
105     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
106     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
107     return s->vhost_net;
108 }
109 
110 static bool vhost_vdpa_net_valid_svq_features(uint64_t features, Error **errp)
111 {
112     uint64_t invalid_dev_features =
113         features & ~vdpa_svq_device_features &
114         /* Transport are all accepted at this point */
115         ~MAKE_64BIT_MASK(VIRTIO_TRANSPORT_F_START,
116                          VIRTIO_TRANSPORT_F_END - VIRTIO_TRANSPORT_F_START);
117 
118     if (invalid_dev_features) {
119         error_setg(errp, "vdpa svq does not work with features 0x%" PRIx64,
120                    invalid_dev_features);
121         return false;
122     }
123 
124     return vhost_svq_valid_features(features, errp);
125 }
126 
127 static int vhost_vdpa_net_check_device_id(struct vhost_net *net)
128 {
129     uint32_t device_id;
130     int ret;
131     struct vhost_dev *hdev;
132 
133     hdev = (struct vhost_dev *)&net->dev;
134     ret = hdev->vhost_ops->vhost_get_device_id(hdev, &device_id);
135     if (device_id != VIRTIO_ID_NET) {
136         return -ENOTSUP;
137     }
138     return ret;
139 }
140 
141 static int vhost_vdpa_add(NetClientState *ncs, void *be,
142                           int queue_pair_index, int nvqs)
143 {
144     VhostNetOptions options;
145     struct vhost_net *net = NULL;
146     VhostVDPAState *s;
147     int ret;
148 
149     options.backend_type = VHOST_BACKEND_TYPE_VDPA;
150     assert(ncs->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
151     s = DO_UPCAST(VhostVDPAState, nc, ncs);
152     options.net_backend = ncs;
153     options.opaque      = be;
154     options.busyloop_timeout = 0;
155     options.nvqs = nvqs;
156 
157     net = vhost_net_init(&options);
158     if (!net) {
159         error_report("failed to init vhost_net for queue");
160         goto err_init;
161     }
162     s->vhost_net = net;
163     ret = vhost_vdpa_net_check_device_id(net);
164     if (ret) {
165         goto err_check;
166     }
167     return 0;
168 err_check:
169     vhost_net_cleanup(net);
170     g_free(net);
171 err_init:
172     return -1;
173 }
174 
175 static void vhost_vdpa_cleanup(NetClientState *nc)
176 {
177     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
178     struct vhost_dev *dev = &s->vhost_net->dev;
179 
180     qemu_vfree(s->cvq_cmd_out_buffer);
181     qemu_vfree(s->status);
182     if (dev->vq_index + dev->nvqs == dev->vq_index_end) {
183         g_clear_pointer(&s->vhost_vdpa.iova_tree, vhost_iova_tree_delete);
184     }
185     if (s->vhost_net) {
186         vhost_net_cleanup(s->vhost_net);
187         g_free(s->vhost_net);
188         s->vhost_net = NULL;
189     }
190      if (s->vhost_vdpa.device_fd >= 0) {
191         qemu_close(s->vhost_vdpa.device_fd);
192         s->vhost_vdpa.device_fd = -1;
193     }
194 }
195 
196 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
197 {
198     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
199 
200     return true;
201 }
202 
203 static bool vhost_vdpa_has_ufo(NetClientState *nc)
204 {
205     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
206     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
207     uint64_t features = 0;
208     features |= (1ULL << VIRTIO_NET_F_HOST_UFO);
209     features = vhost_net_get_features(s->vhost_net, features);
210     return !!(features & (1ULL << VIRTIO_NET_F_HOST_UFO));
211 
212 }
213 
214 static bool vhost_vdpa_check_peer_type(NetClientState *nc, ObjectClass *oc,
215                                        Error **errp)
216 {
217     const char *driver = object_class_get_name(oc);
218 
219     if (!g_str_has_prefix(driver, "virtio-net-")) {
220         error_setg(errp, "vhost-vdpa requires frontend driver virtio-net-*");
221         return false;
222     }
223 
224     return true;
225 }
226 
227 /** Dummy receive in case qemu falls back to userland tap networking */
228 static ssize_t vhost_vdpa_receive(NetClientState *nc, const uint8_t *buf,
229                                   size_t size)
230 {
231     return size;
232 }
233 
234 static NetClientInfo net_vhost_vdpa_info = {
235         .type = NET_CLIENT_DRIVER_VHOST_VDPA,
236         .size = sizeof(VhostVDPAState),
237         .receive = vhost_vdpa_receive,
238         .cleanup = vhost_vdpa_cleanup,
239         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
240         .has_ufo = vhost_vdpa_has_ufo,
241         .check_peer_type = vhost_vdpa_check_peer_type,
242 };
243 
244 static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
245 {
246     VhostIOVATree *tree = v->iova_tree;
247     DMAMap needle = {
248         /*
249          * No need to specify size or to look for more translations since
250          * this contiguous chunk was allocated by us.
251          */
252         .translated_addr = (hwaddr)(uintptr_t)addr,
253     };
254     const DMAMap *map = vhost_iova_tree_find_iova(tree, &needle);
255     int r;
256 
257     if (unlikely(!map)) {
258         error_report("Cannot locate expected map");
259         return;
260     }
261 
262     r = vhost_vdpa_dma_unmap(v, v->address_space_id, map->iova, map->size + 1);
263     if (unlikely(r != 0)) {
264         error_report("Device cannot unmap: %s(%d)", g_strerror(r), r);
265     }
266 
267     vhost_iova_tree_remove(tree, *map);
268 }
269 
270 static size_t vhost_vdpa_net_cvq_cmd_len(void)
271 {
272     /*
273      * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
274      * In buffer is always 1 byte, so it should fit here
275      */
276     return sizeof(struct virtio_net_ctrl_hdr) +
277            2 * sizeof(struct virtio_net_ctrl_mac) +
278            MAC_TABLE_ENTRIES * ETH_ALEN;
279 }
280 
281 static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
282 {
283     return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
284 }
285 
286 /** Map CVQ buffer. */
287 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
288                                   bool write)
289 {
290     DMAMap map = {};
291     int r;
292 
293     map.translated_addr = (hwaddr)(uintptr_t)buf;
294     map.size = size - 1;
295     map.perm = write ? IOMMU_RW : IOMMU_RO,
296     r = vhost_iova_tree_map_alloc(v->iova_tree, &map);
297     if (unlikely(r != IOVA_OK)) {
298         error_report("Cannot map injected element");
299         return r;
300     }
301 
302     r = vhost_vdpa_dma_map(v, v->address_space_id, map.iova,
303                            vhost_vdpa_net_cvq_cmd_page_len(), buf, !write);
304     if (unlikely(r < 0)) {
305         goto dma_map_err;
306     }
307 
308     return 0;
309 
310 dma_map_err:
311     vhost_iova_tree_remove(v->iova_tree, map);
312     return r;
313 }
314 
315 static int vhost_vdpa_net_cvq_start(NetClientState *nc)
316 {
317     VhostVDPAState *s;
318     int r;
319 
320     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
321 
322     s = DO_UPCAST(VhostVDPAState, nc, nc);
323     if (!s->vhost_vdpa.shadow_vqs_enabled) {
324         return 0;
325     }
326 
327     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
328                                vhost_vdpa_net_cvq_cmd_page_len(), false);
329     if (unlikely(r < 0)) {
330         return r;
331     }
332 
333     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->status,
334                                vhost_vdpa_net_cvq_cmd_page_len(), true);
335     if (unlikely(r < 0)) {
336         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
337     }
338 
339     return r;
340 }
341 
342 static void vhost_vdpa_net_cvq_stop(NetClientState *nc)
343 {
344     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
345 
346     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
347 
348     if (s->vhost_vdpa.shadow_vqs_enabled) {
349         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
350         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->status);
351     }
352 }
353 
354 static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s, size_t out_len,
355                                       size_t in_len)
356 {
357     /* Buffers for the device */
358     const struct iovec out = {
359         .iov_base = s->cvq_cmd_out_buffer,
360         .iov_len = out_len,
361     };
362     const struct iovec in = {
363         .iov_base = s->status,
364         .iov_len = sizeof(virtio_net_ctrl_ack),
365     };
366     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
367     int r;
368 
369     r = vhost_svq_add(svq, &out, 1, &in, 1, NULL);
370     if (unlikely(r != 0)) {
371         if (unlikely(r == -ENOSPC)) {
372             qemu_log_mask(LOG_GUEST_ERROR, "%s: No space on device queue\n",
373                           __func__);
374         }
375         return r;
376     }
377 
378     /*
379      * We can poll here since we've had BQL from the time we sent the
380      * descriptor. Also, we need to take the answer before SVQ pulls by itself,
381      * when BQL is released
382      */
383     return vhost_svq_poll(svq);
384 }
385 
386 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s, uint8_t class,
387                                        uint8_t cmd, const void *data,
388                                        size_t data_size)
389 {
390     const struct virtio_net_ctrl_hdr ctrl = {
391         .class = class,
392         .cmd = cmd,
393     };
394 
395     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
396 
397     memcpy(s->cvq_cmd_out_buffer, &ctrl, sizeof(ctrl));
398     memcpy(s->cvq_cmd_out_buffer + sizeof(ctrl), data, data_size);
399 
400     return vhost_vdpa_net_cvq_add(s, sizeof(ctrl) + data_size,
401                                   sizeof(virtio_net_ctrl_ack));
402 }
403 
404 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n)
405 {
406     uint64_t features = n->parent_obj.guest_features;
407     if (features & BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR)) {
408         ssize_t dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MAC,
409                                                   VIRTIO_NET_CTRL_MAC_ADDR_SET,
410                                                   n->mac, sizeof(n->mac));
411         if (unlikely(dev_written < 0)) {
412             return dev_written;
413         }
414 
415         return *s->status != VIRTIO_NET_OK;
416     }
417 
418     return 0;
419 }
420 
421 static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
422                                   const VirtIONet *n)
423 {
424     struct virtio_net_ctrl_mq mq;
425     uint64_t features = n->parent_obj.guest_features;
426     ssize_t dev_written;
427 
428     if (!(features & BIT_ULL(VIRTIO_NET_F_MQ))) {
429         return 0;
430     }
431 
432     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
433     dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MQ,
434                                           VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &mq,
435                                           sizeof(mq));
436     if (unlikely(dev_written < 0)) {
437         return dev_written;
438     }
439 
440     return *s->status != VIRTIO_NET_OK;
441 }
442 
443 static int vhost_vdpa_net_load(NetClientState *nc)
444 {
445     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
446     struct vhost_vdpa *v = &s->vhost_vdpa;
447     const VirtIONet *n;
448     int r;
449 
450     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
451 
452     if (!v->shadow_vqs_enabled) {
453         return 0;
454     }
455 
456     n = VIRTIO_NET(v->dev->vdev);
457     r = vhost_vdpa_net_load_mac(s, n);
458     if (unlikely(r < 0)) {
459         return r;
460     }
461     r = vhost_vdpa_net_load_mq(s, n);
462     if (unlikely(r)) {
463         return r;
464     }
465 
466     return 0;
467 }
468 
469 static NetClientInfo net_vhost_vdpa_cvq_info = {
470     .type = NET_CLIENT_DRIVER_VHOST_VDPA,
471     .size = sizeof(VhostVDPAState),
472     .receive = vhost_vdpa_receive,
473     .start = vhost_vdpa_net_cvq_start,
474     .load = vhost_vdpa_net_load,
475     .stop = vhost_vdpa_net_cvq_stop,
476     .cleanup = vhost_vdpa_cleanup,
477     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
478     .has_ufo = vhost_vdpa_has_ufo,
479     .check_peer_type = vhost_vdpa_check_peer_type,
480 };
481 
482 /**
483  * Validate and copy control virtqueue commands.
484  *
485  * Following QEMU guidelines, we offer a copy of the buffers to the device to
486  * prevent TOCTOU bugs.
487  */
488 static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
489                                             VirtQueueElement *elem,
490                                             void *opaque)
491 {
492     VhostVDPAState *s = opaque;
493     size_t in_len;
494     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
495     /* Out buffer sent to both the vdpa device and the device model */
496     struct iovec out = {
497         .iov_base = s->cvq_cmd_out_buffer,
498     };
499     /* in buffer used for device model */
500     const struct iovec in = {
501         .iov_base = &status,
502         .iov_len = sizeof(status),
503     };
504     ssize_t dev_written = -EINVAL;
505 
506     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
507                              s->cvq_cmd_out_buffer,
508                              vhost_vdpa_net_cvq_cmd_len());
509     dev_written = vhost_vdpa_net_cvq_add(s, out.iov_len, sizeof(status));
510     if (unlikely(dev_written < 0)) {
511         goto out;
512     }
513 
514     if (unlikely(dev_written < sizeof(status))) {
515         error_report("Insufficient written data (%zu)", dev_written);
516         goto out;
517     }
518 
519     if (*s->status != VIRTIO_NET_OK) {
520         return VIRTIO_NET_ERR;
521     }
522 
523     status = VIRTIO_NET_ERR;
524     virtio_net_handle_ctrl_iov(svq->vdev, &in, 1, &out, 1);
525     if (status != VIRTIO_NET_OK) {
526         error_report("Bad CVQ processing in model");
527     }
528 
529 out:
530     in_len = iov_from_buf(elem->in_sg, elem->in_num, 0, &status,
531                           sizeof(status));
532     if (unlikely(in_len < sizeof(status))) {
533         error_report("Bad device CVQ written length");
534     }
535     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
536     g_free(elem);
537     return dev_written < 0 ? dev_written : 0;
538 }
539 
540 static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
541     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
542 };
543 
544 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
545                                        const char *device,
546                                        const char *name,
547                                        int vdpa_device_fd,
548                                        int queue_pair_index,
549                                        int nvqs,
550                                        bool is_datapath,
551                                        bool svq,
552                                        struct vhost_vdpa_iova_range iova_range,
553                                        VhostIOVATree *iova_tree)
554 {
555     NetClientState *nc = NULL;
556     VhostVDPAState *s;
557     int ret = 0;
558     assert(name);
559     if (is_datapath) {
560         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
561                                  name);
562     } else {
563         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
564                                          device, name);
565     }
566     qemu_set_info_str(nc, TYPE_VHOST_VDPA);
567     s = DO_UPCAST(VhostVDPAState, nc, nc);
568 
569     s->vhost_vdpa.device_fd = vdpa_device_fd;
570     s->vhost_vdpa.index = queue_pair_index;
571     s->vhost_vdpa.shadow_vqs_enabled = svq;
572     s->vhost_vdpa.iova_range = iova_range;
573     s->vhost_vdpa.iova_tree = iova_tree;
574     if (!is_datapath) {
575         s->cvq_cmd_out_buffer = qemu_memalign(qemu_real_host_page_size(),
576                                             vhost_vdpa_net_cvq_cmd_page_len());
577         memset(s->cvq_cmd_out_buffer, 0, vhost_vdpa_net_cvq_cmd_page_len());
578         s->status = qemu_memalign(qemu_real_host_page_size(),
579                                   vhost_vdpa_net_cvq_cmd_page_len());
580         memset(s->status, 0, vhost_vdpa_net_cvq_cmd_page_len());
581 
582         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
583         s->vhost_vdpa.shadow_vq_ops_opaque = s;
584     }
585     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
586     if (ret) {
587         qemu_del_net_client(nc);
588         return NULL;
589     }
590     return nc;
591 }
592 
593 static int vhost_vdpa_get_iova_range(int fd,
594                                      struct vhost_vdpa_iova_range *iova_range)
595 {
596     int ret = ioctl(fd, VHOST_VDPA_GET_IOVA_RANGE, iova_range);
597 
598     return ret < 0 ? -errno : 0;
599 }
600 
601 static int vhost_vdpa_get_features(int fd, uint64_t *features, Error **errp)
602 {
603     int ret = ioctl(fd, VHOST_GET_FEATURES, features);
604     if (unlikely(ret < 0)) {
605         error_setg_errno(errp, errno,
606                          "Fail to query features from vhost-vDPA device");
607     }
608     return ret;
609 }
610 
611 static int vhost_vdpa_get_max_queue_pairs(int fd, uint64_t features,
612                                           int *has_cvq, Error **errp)
613 {
614     unsigned long config_size = offsetof(struct vhost_vdpa_config, buf);
615     g_autofree struct vhost_vdpa_config *config = NULL;
616     __virtio16 *max_queue_pairs;
617     int ret;
618 
619     if (features & (1 << VIRTIO_NET_F_CTRL_VQ)) {
620         *has_cvq = 1;
621     } else {
622         *has_cvq = 0;
623     }
624 
625     if (features & (1 << VIRTIO_NET_F_MQ)) {
626         config = g_malloc0(config_size + sizeof(*max_queue_pairs));
627         config->off = offsetof(struct virtio_net_config, max_virtqueue_pairs);
628         config->len = sizeof(*max_queue_pairs);
629 
630         ret = ioctl(fd, VHOST_VDPA_GET_CONFIG, config);
631         if (ret) {
632             error_setg(errp, "Fail to get config from vhost-vDPA device");
633             return -ret;
634         }
635 
636         max_queue_pairs = (__virtio16 *)&config->buf;
637 
638         return lduw_le_p(max_queue_pairs);
639     }
640 
641     return 1;
642 }
643 
644 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
645                         NetClientState *peer, Error **errp)
646 {
647     const NetdevVhostVDPAOptions *opts;
648     uint64_t features;
649     int vdpa_device_fd;
650     g_autofree NetClientState **ncs = NULL;
651     g_autoptr(VhostIOVATree) iova_tree = NULL;
652     struct vhost_vdpa_iova_range iova_range;
653     NetClientState *nc;
654     int queue_pairs, r, i = 0, has_cvq = 0;
655 
656     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
657     opts = &netdev->u.vhost_vdpa;
658     if (!opts->vhostdev && !opts->vhostfd) {
659         error_setg(errp,
660                    "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
661         return -1;
662     }
663 
664     if (opts->vhostdev && opts->vhostfd) {
665         error_setg(errp,
666                    "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
667         return -1;
668     }
669 
670     if (opts->vhostdev) {
671         vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
672         if (vdpa_device_fd == -1) {
673             return -errno;
674         }
675     } else {
676         /* has_vhostfd */
677         vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
678         if (vdpa_device_fd == -1) {
679             error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
680             return -1;
681         }
682     }
683 
684     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
685     if (unlikely(r < 0)) {
686         goto err;
687     }
688 
689     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
690                                                  &has_cvq, errp);
691     if (queue_pairs < 0) {
692         qemu_close(vdpa_device_fd);
693         return queue_pairs;
694     }
695 
696     vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
697     if (opts->x_svq) {
698         if (!vhost_vdpa_net_valid_svq_features(features, errp)) {
699             goto err_svq;
700         }
701 
702         iova_tree = vhost_iova_tree_new(iova_range.first, iova_range.last);
703     }
704 
705     ncs = g_malloc0(sizeof(*ncs) * queue_pairs);
706 
707     for (i = 0; i < queue_pairs; i++) {
708         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
709                                      vdpa_device_fd, i, 2, true, opts->x_svq,
710                                      iova_range, iova_tree);
711         if (!ncs[i])
712             goto err;
713     }
714 
715     if (has_cvq) {
716         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
717                                  vdpa_device_fd, i, 1, false,
718                                  opts->x_svq, iova_range, iova_tree);
719         if (!nc)
720             goto err;
721     }
722 
723     /* iova_tree ownership belongs to last NetClientState */
724     g_steal_pointer(&iova_tree);
725     return 0;
726 
727 err:
728     if (i) {
729         for (i--; i >= 0; i--) {
730             qemu_del_net_client(ncs[i]);
731         }
732     }
733 
734 err_svq:
735     qemu_close(vdpa_device_fd);
736 
737     return -1;
738 }
739