xref: /openbmc/qemu/net/vhost-vdpa.c (revision 1652f1b335fb5bec921c64ff7f378e6732510ca4)
1 /*
2  * vhost-vdpa.c
3  *
4  * Copyright(c) 2017-2018 Intel Corporation.
5  * Copyright(c) 2020 Red Hat, Inc.
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or later.
8  * See the COPYING file in the top-level directory.
9  *
10  */
11 
12 #include "qemu/osdep.h"
13 #include "clients.h"
14 #include "hw/virtio/virtio-net.h"
15 #include "net/vhost_net.h"
16 #include "net/vhost-vdpa.h"
17 #include "hw/virtio/vhost-vdpa.h"
18 #include "qemu/config-file.h"
19 #include "qemu/error-report.h"
20 #include "qemu/log.h"
21 #include "qemu/memalign.h"
22 #include "qemu/option.h"
23 #include "qapi/error.h"
24 #include <linux/vhost.h>
25 #include <sys/ioctl.h>
26 #include <err.h>
27 #include "standard-headers/linux/virtio_net.h"
28 #include "monitor/monitor.h"
29 #include "migration/misc.h"
30 #include "hw/virtio/vhost.h"
31 #include "trace.h"
32 
33 /* Todo:need to add the multiqueue support here */
34 typedef struct VhostVDPAState {
35     NetClientState nc;
36     struct vhost_vdpa vhost_vdpa;
37     NotifierWithReturn migration_state;
38     VHostNetState *vhost_net;
39 
40     /* Control commands shadow buffers */
41     void *cvq_cmd_out_buffer;
42     virtio_net_ctrl_ack *status;
43 
44     /* The device always have SVQ enabled */
45     bool always_svq;
46 
47     /* The device can isolate CVQ in its own ASID */
48     bool cvq_isolated;
49 
50     bool started;
51 } VhostVDPAState;
52 
53 /*
54  * The array is sorted alphabetically in ascending order,
55  * with the exception of VHOST_INVALID_FEATURE_BIT,
56  * which should always be the last entry.
57  */
58 static const int vdpa_feature_bits[] = {
59     VIRTIO_F_ANY_LAYOUT,
60     VIRTIO_F_IOMMU_PLATFORM,
61     VIRTIO_F_NOTIFY_ON_EMPTY,
62     VIRTIO_F_RING_PACKED,
63     VIRTIO_F_RING_RESET,
64     VIRTIO_F_VERSION_1,
65     VIRTIO_F_IN_ORDER,
66     VIRTIO_F_NOTIFICATION_DATA,
67     VIRTIO_NET_F_CSUM,
68     VIRTIO_NET_F_CTRL_GUEST_OFFLOADS,
69     VIRTIO_NET_F_CTRL_MAC_ADDR,
70     VIRTIO_NET_F_CTRL_RX,
71     VIRTIO_NET_F_CTRL_RX_EXTRA,
72     VIRTIO_NET_F_CTRL_VLAN,
73     VIRTIO_NET_F_CTRL_VQ,
74     VIRTIO_NET_F_GSO,
75     VIRTIO_NET_F_GUEST_CSUM,
76     VIRTIO_NET_F_GUEST_ECN,
77     VIRTIO_NET_F_GUEST_TSO4,
78     VIRTIO_NET_F_GUEST_TSO6,
79     VIRTIO_NET_F_GUEST_UFO,
80     VIRTIO_NET_F_GUEST_USO4,
81     VIRTIO_NET_F_GUEST_USO6,
82     VIRTIO_NET_F_HASH_REPORT,
83     VIRTIO_NET_F_HOST_ECN,
84     VIRTIO_NET_F_HOST_TSO4,
85     VIRTIO_NET_F_HOST_TSO6,
86     VIRTIO_NET_F_HOST_UFO,
87     VIRTIO_NET_F_HOST_USO,
88     VIRTIO_NET_F_MQ,
89     VIRTIO_NET_F_MRG_RXBUF,
90     VIRTIO_NET_F_MTU,
91     VIRTIO_NET_F_RSC_EXT,
92     VIRTIO_NET_F_RSS,
93     VIRTIO_NET_F_STATUS,
94     VIRTIO_RING_F_EVENT_IDX,
95     VIRTIO_RING_F_INDIRECT_DESC,
96 
97     /* VHOST_INVALID_FEATURE_BIT should always be the last entry */
98     VHOST_INVALID_FEATURE_BIT
99 };
100 
101 /** Supported device specific feature bits with SVQ */
102 static const uint64_t vdpa_svq_device_features =
103     BIT_ULL(VIRTIO_NET_F_CSUM) |
104     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
105     BIT_ULL(VIRTIO_NET_F_CTRL_GUEST_OFFLOADS) |
106     BIT_ULL(VIRTIO_NET_F_MTU) |
107     BIT_ULL(VIRTIO_NET_F_MAC) |
108     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |
109     BIT_ULL(VIRTIO_NET_F_GUEST_TSO6) |
110     BIT_ULL(VIRTIO_NET_F_GUEST_ECN) |
111     BIT_ULL(VIRTIO_NET_F_GUEST_UFO) |
112     BIT_ULL(VIRTIO_NET_F_HOST_TSO4) |
113     BIT_ULL(VIRTIO_NET_F_HOST_TSO6) |
114     BIT_ULL(VIRTIO_NET_F_HOST_ECN) |
115     BIT_ULL(VIRTIO_NET_F_HOST_UFO) |
116     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
117     BIT_ULL(VIRTIO_NET_F_STATUS) |
118     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
119     BIT_ULL(VIRTIO_NET_F_CTRL_RX) |
120     BIT_ULL(VIRTIO_NET_F_CTRL_VLAN) |
121     BIT_ULL(VIRTIO_NET_F_CTRL_RX_EXTRA) |
122     BIT_ULL(VIRTIO_NET_F_MQ) |
123     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
124     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |
125     /* VHOST_F_LOG_ALL is exposed by SVQ */
126     BIT_ULL(VHOST_F_LOG_ALL) |
127     BIT_ULL(VIRTIO_NET_F_HASH_REPORT) |
128     BIT_ULL(VIRTIO_NET_F_RSS) |
129     BIT_ULL(VIRTIO_NET_F_RSC_EXT) |
130     BIT_ULL(VIRTIO_NET_F_STANDBY) |
131     BIT_ULL(VIRTIO_NET_F_SPEED_DUPLEX);
132 
133 #define VHOST_VDPA_NET_CVQ_ASID 1
134 
135 static struct vhost_net *vhost_vdpa_get_vhost_net(NetClientState *nc)
136 {
137     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
138     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
139     return s->vhost_net;
140 }
141 
142 static size_t vhost_vdpa_net_cvq_cmd_len(void)
143 {
144     /*
145      * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
146      * In buffer is always 1 byte, so it should fit here
147      */
148     return sizeof(struct virtio_net_ctrl_hdr) +
149            2 * sizeof(struct virtio_net_ctrl_mac) +
150            MAC_TABLE_ENTRIES * ETH_ALEN;
151 }
152 
153 static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
154 {
155     return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
156 }
157 
158 static bool vhost_vdpa_net_valid_svq_features(uint64_t features, Error **errp)
159 {
160     uint64_t invalid_dev_features =
161         features & ~vdpa_svq_device_features &
162         /* Transport are all accepted at this point */
163         ~MAKE_64BIT_MASK(VIRTIO_TRANSPORT_F_START,
164                          VIRTIO_TRANSPORT_F_END - VIRTIO_TRANSPORT_F_START);
165 
166     if (invalid_dev_features) {
167         error_setg(errp, "vdpa svq does not work with features 0x%" PRIx64,
168                    invalid_dev_features);
169         return false;
170     }
171 
172     return vhost_svq_valid_features(features, errp);
173 }
174 
175 static int vhost_vdpa_net_check_device_id(struct vhost_net *net)
176 {
177     uint32_t device_id;
178     int ret;
179     struct vhost_dev *hdev;
180 
181     hdev = (struct vhost_dev *)&net->dev;
182     ret = hdev->vhost_ops->vhost_get_device_id(hdev, &device_id);
183     if (device_id != VIRTIO_ID_NET) {
184         return -ENOTSUP;
185     }
186     return ret;
187 }
188 
189 static int vhost_vdpa_add(NetClientState *ncs, void *be,
190                           int queue_pair_index, int nvqs)
191 {
192     VhostNetOptions options;
193     struct vhost_net *net = NULL;
194     VhostVDPAState *s;
195     int ret;
196 
197     options.backend_type = VHOST_BACKEND_TYPE_VDPA;
198     assert(ncs->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
199     s = DO_UPCAST(VhostVDPAState, nc, ncs);
200     options.net_backend = ncs;
201     options.opaque      = be;
202     options.busyloop_timeout = 0;
203     options.nvqs = nvqs;
204     options.feature_bits = vdpa_feature_bits;
205     options.get_acked_features = NULL;
206     options.save_acked_features = NULL;
207 
208     net = vhost_net_init(&options);
209     if (!net) {
210         error_report("failed to init vhost_net for queue");
211         goto err_init;
212     }
213     s->vhost_net = net;
214     ret = vhost_vdpa_net_check_device_id(net);
215     if (ret) {
216         goto err_check;
217     }
218     return 0;
219 err_check:
220     vhost_net_cleanup(net);
221     g_free(net);
222 err_init:
223     return -1;
224 }
225 
226 static void vhost_vdpa_cleanup(NetClientState *nc)
227 {
228     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
229 
230     munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
231     munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
232     if (s->vhost_net) {
233         vhost_net_cleanup(s->vhost_net);
234         g_free(s->vhost_net);
235         s->vhost_net = NULL;
236     }
237     if (s->vhost_vdpa.index != 0) {
238         return;
239     }
240     qemu_close(s->vhost_vdpa.shared->device_fd);
241     g_clear_pointer(&s->vhost_vdpa.shared->iova_tree, vhost_iova_tree_delete);
242     g_free(s->vhost_vdpa.shared);
243 }
244 
245 /** Dummy SetSteeringEBPF to support RSS for vhost-vdpa backend  */
246 static bool vhost_vdpa_set_steering_ebpf(NetClientState *nc, int prog_fd)
247 {
248     return true;
249 }
250 
251 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
252 {
253     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
254 
255     return true;
256 }
257 
258 static bool vhost_vdpa_has_ufo(NetClientState *nc)
259 {
260     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
261     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
262     uint64_t features = 0;
263     features |= (1ULL << VIRTIO_NET_F_HOST_UFO);
264     features = vhost_net_get_features(s->vhost_net, features);
265     return !!(features & (1ULL << VIRTIO_NET_F_HOST_UFO));
266 
267 }
268 
269 /*
270  * FIXME: vhost_vdpa doesn't have an API to "set h/w endianness". But it's
271  * reasonable to assume that h/w is LE by default, because LE is what
272  * virtio 1.0 and later ask for. So, this function just says "yes, the h/w is
273  * LE". Otherwise, on a BE machine, higher-level code would mistakely think
274  * the h/w is BE and can't support VDPA for a virtio 1.0 client.
275  */
276 static int vhost_vdpa_set_vnet_le(NetClientState *nc, bool enable)
277 {
278     return 0;
279 }
280 
281 static bool vhost_vdpa_check_peer_type(NetClientState *nc, ObjectClass *oc,
282                                        Error **errp)
283 {
284     const char *driver = object_class_get_name(oc);
285 
286     if (!g_str_has_prefix(driver, "virtio-net-")) {
287         error_setg(errp, "vhost-vdpa requires frontend driver virtio-net-*");
288         return false;
289     }
290 
291     return true;
292 }
293 
294 /** Dummy receive in case qemu falls back to userland tap networking */
295 static ssize_t vhost_vdpa_receive(NetClientState *nc, const uint8_t *buf,
296                                   size_t size)
297 {
298     return size;
299 }
300 
301 
302 /** From any vdpa net client, get the netclient of the i-th queue pair */
303 static VhostVDPAState *vhost_vdpa_net_get_nc_vdpa(VhostVDPAState *s, int i)
304 {
305     NICState *nic = qemu_get_nic(s->nc.peer);
306     NetClientState *nc_i = qemu_get_peer(nic->ncs, i);
307 
308     return DO_UPCAST(VhostVDPAState, nc, nc_i);
309 }
310 
311 static VhostVDPAState *vhost_vdpa_net_first_nc_vdpa(VhostVDPAState *s)
312 {
313     return vhost_vdpa_net_get_nc_vdpa(s, 0);
314 }
315 
316 static void vhost_vdpa_net_log_global_enable(VhostVDPAState *s, bool enable)
317 {
318     struct vhost_vdpa *v = &s->vhost_vdpa;
319     VirtIONet *n;
320     VirtIODevice *vdev;
321     int data_queue_pairs, cvq, r;
322 
323     /* We are only called on the first data vqs and only if x-svq is not set */
324     if (s->vhost_vdpa.shadow_vqs_enabled == enable) {
325         return;
326     }
327 
328     vdev = v->dev->vdev;
329     n = VIRTIO_NET(vdev);
330     if (!n->vhost_started) {
331         return;
332     }
333 
334     data_queue_pairs = n->multiqueue ? n->max_queue_pairs : 1;
335     cvq = virtio_vdev_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) ?
336                                   n->max_ncs - n->max_queue_pairs : 0;
337     v->shared->svq_switching = enable ?
338         SVQ_TSTATE_ENABLING : SVQ_TSTATE_DISABLING;
339     /*
340      * TODO: vhost_net_stop does suspend, get_base and reset. We can be smarter
341      * in the future and resume the device if read-only operations between
342      * suspend and reset goes wrong.
343      */
344     vhost_net_stop(vdev, n->nic->ncs, data_queue_pairs, cvq);
345 
346     /* Start will check migration setup_or_active to configure or not SVQ */
347     r = vhost_net_start(vdev, n->nic->ncs, data_queue_pairs, cvq);
348     if (unlikely(r < 0)) {
349         error_report("unable to start vhost net: %s(%d)", g_strerror(-r), -r);
350     }
351     v->shared->svq_switching = SVQ_TSTATE_DONE;
352 }
353 
354 static int vdpa_net_migration_state_notifier(NotifierWithReturn *notifier,
355                                              MigrationEvent *e, Error **errp)
356 {
357     VhostVDPAState *s = container_of(notifier, VhostVDPAState, migration_state);
358 
359     if (e->type == MIG_EVENT_PRECOPY_SETUP) {
360         vhost_vdpa_net_log_global_enable(s, true);
361     } else if (e->type == MIG_EVENT_PRECOPY_FAILED) {
362         vhost_vdpa_net_log_global_enable(s, false);
363     }
364     return 0;
365 }
366 
367 static void vhost_vdpa_net_data_start_first(VhostVDPAState *s)
368 {
369     migration_add_notifier(&s->migration_state,
370                            vdpa_net_migration_state_notifier);
371 }
372 
373 static int vhost_vdpa_net_data_start(NetClientState *nc)
374 {
375     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
376     struct vhost_vdpa *v = &s->vhost_vdpa;
377 
378     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
379 
380     if (s->always_svq || migration_is_running()) {
381         v->shadow_vqs_enabled = true;
382     } else {
383         v->shadow_vqs_enabled = false;
384     }
385 
386     if (v->index == 0) {
387         v->shared->shadow_data = v->shadow_vqs_enabled;
388         vhost_vdpa_net_data_start_first(s);
389         return 0;
390     }
391 
392     return 0;
393 }
394 
395 static int vhost_vdpa_net_data_load(NetClientState *nc)
396 {
397     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
398     struct vhost_vdpa *v = &s->vhost_vdpa;
399     bool has_cvq = v->dev->vq_index_end % 2;
400 
401     if (has_cvq) {
402         return 0;
403     }
404 
405     for (int i = 0; i < v->dev->nvqs; ++i) {
406         int ret = vhost_vdpa_set_vring_ready(v, i + v->dev->vq_index);
407         if (ret < 0) {
408             return ret;
409         }
410     }
411     return 0;
412 }
413 
414 static void vhost_vdpa_net_client_stop(NetClientState *nc)
415 {
416     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
417 
418     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
419 
420     if (s->vhost_vdpa.index == 0) {
421         migration_remove_notifier(&s->migration_state);
422     }
423 }
424 
425 static NetClientInfo net_vhost_vdpa_info = {
426         .type = NET_CLIENT_DRIVER_VHOST_VDPA,
427         .size = sizeof(VhostVDPAState),
428         .receive = vhost_vdpa_receive,
429         .start = vhost_vdpa_net_data_start,
430         .load = vhost_vdpa_net_data_load,
431         .stop = vhost_vdpa_net_client_stop,
432         .cleanup = vhost_vdpa_cleanup,
433         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
434         .has_ufo = vhost_vdpa_has_ufo,
435         .set_vnet_le = vhost_vdpa_set_vnet_le,
436         .check_peer_type = vhost_vdpa_check_peer_type,
437         .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
438         .get_vhost_net = vhost_vdpa_get_vhost_net,
439 };
440 
441 static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
442                                           Error **errp)
443 {
444     struct vhost_vring_state state = {
445         .index = vq_index,
446     };
447     int r = ioctl(device_fd, VHOST_VDPA_GET_VRING_GROUP, &state);
448 
449     if (unlikely(r < 0)) {
450         r = -errno;
451         error_setg_errno(errp, errno, "Cannot get VQ %u group", vq_index);
452         return r;
453     }
454 
455     return state.num;
456 }
457 
458 static int vhost_vdpa_set_address_space_id(struct vhost_vdpa *v,
459                                            unsigned vq_group,
460                                            unsigned asid_num)
461 {
462     struct vhost_vring_state asid = {
463         .index = vq_group,
464         .num = asid_num,
465     };
466     int r;
467 
468     trace_vhost_vdpa_set_address_space_id(v, vq_group, asid_num);
469 
470     r = ioctl(v->shared->device_fd, VHOST_VDPA_SET_GROUP_ASID, &asid);
471     if (unlikely(r < 0)) {
472         error_report("Can't set vq group %u asid %u, errno=%d (%s)",
473                      asid.index, asid.num, errno, g_strerror(errno));
474     }
475     return r;
476 }
477 
478 static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
479 {
480     VhostIOVATree *tree = v->shared->iova_tree;
481     DMAMap needle = {
482         /*
483          * No need to specify size or to look for more translations since
484          * this contiguous chunk was allocated by us.
485          */
486         .translated_addr = (hwaddr)(uintptr_t)addr,
487     };
488     const DMAMap *map = vhost_iova_tree_find_iova(tree, &needle);
489     int r;
490 
491     if (unlikely(!map)) {
492         error_report("Cannot locate expected map");
493         return;
494     }
495 
496     r = vhost_vdpa_dma_unmap(v->shared, v->address_space_id, map->iova,
497                              map->size + 1);
498     if (unlikely(r != 0)) {
499         error_report("Device cannot unmap: %s(%d)", g_strerror(r), r);
500     }
501 
502     vhost_iova_tree_remove(tree, *map);
503 }
504 
505 /** Map CVQ buffer. */
506 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
507                                   bool write)
508 {
509     DMAMap map = {};
510     hwaddr taddr = (hwaddr)(uintptr_t)buf;
511     int r;
512 
513     map.size = size - 1;
514     map.perm = write ? IOMMU_RW : IOMMU_RO,
515     r = vhost_iova_tree_map_alloc(v->shared->iova_tree, &map, taddr);
516     if (unlikely(r != IOVA_OK)) {
517         error_report("Cannot map injected element");
518 
519         if (map.translated_addr == taddr) {
520             error_report("Insertion to IOVA->HVA tree failed");
521             /* Remove the mapping from the IOVA-only tree */
522             goto dma_map_err;
523         }
524         return r;
525     }
526 
527     r = vhost_vdpa_dma_map(v->shared, v->address_space_id, map.iova,
528                            vhost_vdpa_net_cvq_cmd_page_len(), buf, !write);
529     if (unlikely(r < 0)) {
530         goto dma_map_err;
531     }
532 
533     return 0;
534 
535 dma_map_err:
536     vhost_iova_tree_remove(v->shared->iova_tree, map);
537     return r;
538 }
539 
540 static int vhost_vdpa_net_cvq_start(NetClientState *nc)
541 {
542     VhostVDPAState *s, *s0;
543     struct vhost_vdpa *v;
544     int64_t cvq_group;
545     int r;
546     Error *err = NULL;
547 
548     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
549 
550     s = DO_UPCAST(VhostVDPAState, nc, nc);
551     v = &s->vhost_vdpa;
552 
553     s0 = vhost_vdpa_net_first_nc_vdpa(s);
554     v->shadow_vqs_enabled = s0->vhost_vdpa.shadow_vqs_enabled;
555     s->vhost_vdpa.address_space_id = VHOST_VDPA_GUEST_PA_ASID;
556 
557     if (v->shared->shadow_data) {
558         /* SVQ is already configured for all virtqueues */
559         goto out;
560     }
561 
562     /*
563      * If we early return in these cases SVQ will not be enabled. The migration
564      * will be blocked as long as vhost-vdpa backends will not offer _F_LOG.
565      */
566     if (!vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
567         return 0;
568     }
569 
570     if (!s->cvq_isolated) {
571         return 0;
572     }
573 
574     cvq_group = vhost_vdpa_get_vring_group(v->shared->device_fd,
575                                            v->dev->vq_index_end - 1,
576                                            &err);
577     if (unlikely(cvq_group < 0)) {
578         error_report_err(err);
579         return cvq_group;
580     }
581 
582     r = vhost_vdpa_set_address_space_id(v, cvq_group, VHOST_VDPA_NET_CVQ_ASID);
583     if (unlikely(r < 0)) {
584         return r;
585     }
586 
587     v->shadow_vqs_enabled = true;
588     s->vhost_vdpa.address_space_id = VHOST_VDPA_NET_CVQ_ASID;
589 
590 out:
591     if (!s->vhost_vdpa.shadow_vqs_enabled) {
592         return 0;
593     }
594 
595     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
596                                vhost_vdpa_net_cvq_cmd_page_len(), false);
597     if (unlikely(r < 0)) {
598         return r;
599     }
600 
601     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->status,
602                                vhost_vdpa_net_cvq_cmd_page_len(), true);
603     if (unlikely(r < 0)) {
604         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
605     }
606 
607     return r;
608 }
609 
610 static void vhost_vdpa_net_cvq_stop(NetClientState *nc)
611 {
612     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
613 
614     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
615 
616     if (s->vhost_vdpa.shadow_vqs_enabled) {
617         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
618         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->status);
619     }
620 
621     vhost_vdpa_net_client_stop(nc);
622 }
623 
624 static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s,
625                                     const struct iovec *out_sg, size_t out_num,
626                                     const struct iovec *in_sg, size_t in_num)
627 {
628     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
629     int r;
630 
631     r = vhost_svq_add(svq, out_sg, out_num, NULL, in_sg, in_num, NULL, NULL);
632     if (unlikely(r != 0)) {
633         if (unlikely(r == -ENOSPC)) {
634             qemu_log_mask(LOG_GUEST_ERROR, "%s: No space on device queue\n",
635                           __func__);
636         }
637     }
638 
639     return r;
640 }
641 
642 /*
643  * Convenience wrapper to poll SVQ for multiple control commands.
644  *
645  * Caller should hold the BQL when invoking this function, and should take
646  * the answer before SVQ pulls by itself when BQL is released.
647  */
648 static ssize_t vhost_vdpa_net_svq_poll(VhostVDPAState *s, size_t cmds_in_flight)
649 {
650     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
651     return vhost_svq_poll(svq, cmds_in_flight);
652 }
653 
654 static void vhost_vdpa_net_load_cursor_reset(VhostVDPAState *s,
655                                              struct iovec *out_cursor,
656                                              struct iovec *in_cursor)
657 {
658     /* reset the cursor of the output buffer for the device */
659     out_cursor->iov_base = s->cvq_cmd_out_buffer;
660     out_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
661 
662     /* reset the cursor of the in buffer for the device */
663     in_cursor->iov_base = s->status;
664     in_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
665 }
666 
667 /*
668  * Poll SVQ for multiple pending control commands and check the device's ack.
669  *
670  * Caller should hold the BQL when invoking this function.
671  *
672  * @s: The VhostVDPAState
673  * @len: The length of the pending status shadow buffer
674  */
675 static ssize_t vhost_vdpa_net_svq_flush(VhostVDPAState *s, size_t len)
676 {
677     /* device uses a one-byte length ack for each control command */
678     ssize_t dev_written = vhost_vdpa_net_svq_poll(s, len);
679     if (unlikely(dev_written != len)) {
680         return -EIO;
681     }
682 
683     /* check the device's ack */
684     for (int i = 0; i < len; ++i) {
685         if (s->status[i] != VIRTIO_NET_OK) {
686             return -EIO;
687         }
688     }
689     return 0;
690 }
691 
692 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s,
693                                        struct iovec *out_cursor,
694                                        struct iovec *in_cursor, uint8_t class,
695                                        uint8_t cmd, const struct iovec *data_sg,
696                                        size_t data_num)
697 {
698     const struct virtio_net_ctrl_hdr ctrl = {
699         .class = class,
700         .cmd = cmd,
701     };
702     size_t data_size = iov_size(data_sg, data_num), cmd_size;
703     struct iovec out, in;
704     ssize_t r;
705     unsigned dummy_cursor_iov_cnt;
706     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
707 
708     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
709     cmd_size = sizeof(ctrl) + data_size;
710     trace_vhost_vdpa_net_load_cmd(s, class, cmd, data_num, data_size);
711     if (vhost_svq_available_slots(svq) < 2 ||
712         iov_size(out_cursor, 1) < cmd_size) {
713         /*
714          * It is time to flush all pending control commands if SVQ is full
715          * or control commands shadow buffers are full.
716          *
717          * We can poll here since we've had BQL from the time
718          * we sent the descriptor.
719          */
720         r = vhost_vdpa_net_svq_flush(s, in_cursor->iov_base -
721                                      (void *)s->status);
722         if (unlikely(r < 0)) {
723             return r;
724         }
725 
726         vhost_vdpa_net_load_cursor_reset(s, out_cursor, in_cursor);
727     }
728 
729     /* pack the CVQ command header */
730     iov_from_buf(out_cursor, 1, 0, &ctrl, sizeof(ctrl));
731     /* pack the CVQ command command-specific-data */
732     iov_to_buf(data_sg, data_num, 0,
733                out_cursor->iov_base + sizeof(ctrl), data_size);
734 
735     /* extract the required buffer from the cursor for output */
736     iov_copy(&out, 1, out_cursor, 1, 0, cmd_size);
737     /* extract the required buffer from the cursor for input */
738     iov_copy(&in, 1, in_cursor, 1, 0, sizeof(*s->status));
739 
740     r = vhost_vdpa_net_cvq_add(s, &out, 1, &in, 1);
741     if (unlikely(r < 0)) {
742         trace_vhost_vdpa_net_load_cmd_retval(s, class, cmd, r);
743         return r;
744     }
745 
746     /* iterate the cursors */
747     dummy_cursor_iov_cnt = 1;
748     iov_discard_front(&out_cursor, &dummy_cursor_iov_cnt, cmd_size);
749     dummy_cursor_iov_cnt = 1;
750     iov_discard_front(&in_cursor, &dummy_cursor_iov_cnt, sizeof(*s->status));
751 
752     return 0;
753 }
754 
755 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n,
756                                    struct iovec *out_cursor,
757                                    struct iovec *in_cursor)
758 {
759     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
760         const struct iovec data = {
761             .iov_base = (void *)n->mac,
762             .iov_len = sizeof(n->mac),
763         };
764         ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
765                                             VIRTIO_NET_CTRL_MAC,
766                                             VIRTIO_NET_CTRL_MAC_ADDR_SET,
767                                             &data, 1);
768         if (unlikely(r < 0)) {
769             return r;
770         }
771     }
772 
773     /*
774      * According to VirtIO standard, "The device MUST have an
775      * empty MAC filtering table on reset.".
776      *
777      * Therefore, there is no need to send this CVQ command if the
778      * driver also sets an empty MAC filter table, which aligns with
779      * the device's defaults.
780      *
781      * Note that the device's defaults can mismatch the driver's
782      * configuration only at live migration.
783      */
784     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX) ||
785         n->mac_table.in_use == 0) {
786         return 0;
787     }
788 
789     uint32_t uni_entries = n->mac_table.first_multi,
790              uni_macs_size = uni_entries * ETH_ALEN,
791              mul_entries = n->mac_table.in_use - uni_entries,
792              mul_macs_size = mul_entries * ETH_ALEN;
793     struct virtio_net_ctrl_mac uni = {
794         .entries = cpu_to_le32(uni_entries),
795     };
796     struct virtio_net_ctrl_mac mul = {
797         .entries = cpu_to_le32(mul_entries),
798     };
799     const struct iovec data[] = {
800         {
801             .iov_base = &uni,
802             .iov_len = sizeof(uni),
803         }, {
804             .iov_base = n->mac_table.macs,
805             .iov_len = uni_macs_size,
806         }, {
807             .iov_base = &mul,
808             .iov_len = sizeof(mul),
809         }, {
810             .iov_base = &n->mac_table.macs[uni_macs_size],
811             .iov_len = mul_macs_size,
812         },
813     };
814     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
815                                         VIRTIO_NET_CTRL_MAC,
816                                         VIRTIO_NET_CTRL_MAC_TABLE_SET,
817                                         data, ARRAY_SIZE(data));
818     if (unlikely(r < 0)) {
819         return r;
820     }
821 
822     return 0;
823 }
824 
825 static int vhost_vdpa_net_load_rss(VhostVDPAState *s, const VirtIONet *n,
826                                    struct iovec *out_cursor,
827                                    struct iovec *in_cursor, bool do_rss)
828 {
829     struct virtio_net_rss_config cfg = {};
830     ssize_t r;
831     g_autofree uint16_t *table = NULL;
832 
833     /*
834      * According to VirtIO standard, "Initially the device has all hash
835      * types disabled and reports only VIRTIO_NET_HASH_REPORT_NONE.".
836      *
837      * Therefore, there is no need to send this CVQ command if the
838      * driver disables the all hash types, which aligns with
839      * the device's defaults.
840      *
841      * Note that the device's defaults can mismatch the driver's
842      * configuration only at live migration.
843      */
844     if (!n->rss_data.enabled ||
845         n->rss_data.hash_types == VIRTIO_NET_HASH_REPORT_NONE) {
846         return 0;
847     }
848 
849     table = g_malloc_n(n->rss_data.indirections_len,
850                        sizeof(n->rss_data.indirections_table[0]));
851     cfg.hash_types = cpu_to_le32(n->rss_data.hash_types);
852 
853     if (do_rss) {
854         /*
855          * According to VirtIO standard, "Number of entries in indirection_table
856          * is (indirection_table_mask + 1)".
857          */
858         cfg.indirection_table_mask = cpu_to_le16(n->rss_data.indirections_len -
859                                                  1);
860         cfg.unclassified_queue = cpu_to_le16(n->rss_data.default_queue);
861         for (int i = 0; i < n->rss_data.indirections_len; ++i) {
862             table[i] = cpu_to_le16(n->rss_data.indirections_table[i]);
863         }
864         cfg.max_tx_vq = cpu_to_le16(n->curr_queue_pairs);
865     } else {
866         /*
867          * According to VirtIO standard, "Field reserved MUST contain zeroes.
868          * It is defined to make the structure to match the layout of
869          * virtio_net_rss_config structure, defined in 5.1.6.5.7.".
870          *
871          * Therefore, we need to zero the fields in
872          * struct virtio_net_rss_config, which corresponds to the
873          * `reserved` field in struct virtio_net_hash_config.
874          *
875          * Note that all other fields are zeroed at their definitions,
876          * except for the `indirection_table` field, where the actual data
877          * is stored in the `table` variable to ensure compatibility
878          * with RSS case. Therefore, we need to zero the `table` variable here.
879          */
880         table[0] = 0;
881     }
882 
883     /*
884      * Considering that virtio_net_handle_rss() currently does not restore
885      * the hash key length parsed from the CVQ command sent from the guest
886      * into n->rss_data and uses the maximum key length in other code, so
887      * we also employ the maximum key length here.
888      */
889     cfg.hash_key_length = sizeof(n->rss_data.key);
890 
891     const struct iovec data[] = {
892         {
893             .iov_base = &cfg,
894             .iov_len = offsetof(struct virtio_net_rss_config,
895                                 indirection_table),
896         }, {
897             .iov_base = table,
898             .iov_len = n->rss_data.indirections_len *
899                        sizeof(n->rss_data.indirections_table[0]),
900         }, {
901             .iov_base = &cfg.max_tx_vq,
902             .iov_len = offsetof(struct virtio_net_rss_config, hash_key_data) -
903                        offsetof(struct virtio_net_rss_config, max_tx_vq),
904         }, {
905             .iov_base = (void *)n->rss_data.key,
906             .iov_len = sizeof(n->rss_data.key),
907         }
908     };
909 
910     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
911                                 VIRTIO_NET_CTRL_MQ,
912                                 do_rss ? VIRTIO_NET_CTRL_MQ_RSS_CONFIG :
913                                 VIRTIO_NET_CTRL_MQ_HASH_CONFIG,
914                                 data, ARRAY_SIZE(data));
915     if (unlikely(r < 0)) {
916         return r;
917     }
918 
919     return 0;
920 }
921 
922 static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
923                                   const VirtIONet *n,
924                                   struct iovec *out_cursor,
925                                   struct iovec *in_cursor)
926 {
927     struct virtio_net_ctrl_mq mq;
928     ssize_t r;
929 
930     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_MQ)) {
931         return 0;
932     }
933 
934     trace_vhost_vdpa_net_load_mq(s, n->curr_queue_pairs);
935 
936     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
937     const struct iovec data = {
938         .iov_base = &mq,
939         .iov_len = sizeof(mq),
940     };
941     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
942                                 VIRTIO_NET_CTRL_MQ,
943                                 VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET,
944                                 &data, 1);
945     if (unlikely(r < 0)) {
946         return r;
947     }
948 
949     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_RSS)) {
950         /* load the receive-side scaling state */
951         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, true);
952         if (unlikely(r < 0)) {
953             return r;
954         }
955     } else if (virtio_vdev_has_feature(&n->parent_obj,
956                                        VIRTIO_NET_F_HASH_REPORT)) {
957         /* load the hash calculation state */
958         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, false);
959         if (unlikely(r < 0)) {
960             return r;
961         }
962     }
963 
964     return 0;
965 }
966 
967 static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
968                                         const VirtIONet *n,
969                                         struct iovec *out_cursor,
970                                         struct iovec *in_cursor)
971 {
972     uint64_t offloads;
973     ssize_t r;
974 
975     if (!virtio_vdev_has_feature(&n->parent_obj,
976                                  VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) {
977         return 0;
978     }
979 
980     if (n->curr_guest_offloads == virtio_net_supported_guest_offloads(n)) {
981         /*
982          * According to VirtIO standard, "Upon feature negotiation
983          * corresponding offload gets enabled to preserve
984          * backward compatibility.".
985          *
986          * Therefore, there is no need to send this CVQ command if the
987          * driver also enables all supported offloads, which aligns with
988          * the device's defaults.
989          *
990          * Note that the device's defaults can mismatch the driver's
991          * configuration only at live migration.
992          */
993         return 0;
994     }
995 
996     offloads = cpu_to_le64(n->curr_guest_offloads);
997     const struct iovec data = {
998         .iov_base = &offloads,
999         .iov_len = sizeof(offloads),
1000     };
1001     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1002                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS,
1003                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET,
1004                                 &data, 1);
1005     if (unlikely(r < 0)) {
1006         return r;
1007     }
1008 
1009     return 0;
1010 }
1011 
1012 static int vhost_vdpa_net_load_rx_mode(VhostVDPAState *s,
1013                                        struct iovec *out_cursor,
1014                                        struct iovec *in_cursor,
1015                                        uint8_t cmd,
1016                                        uint8_t on)
1017 {
1018     const struct iovec data = {
1019         .iov_base = &on,
1020         .iov_len = sizeof(on),
1021     };
1022     ssize_t r;
1023 
1024     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1025                                 VIRTIO_NET_CTRL_RX, cmd, &data, 1);
1026     if (unlikely(r < 0)) {
1027         return r;
1028     }
1029 
1030     return 0;
1031 }
1032 
1033 static int vhost_vdpa_net_load_rx(VhostVDPAState *s,
1034                                   const VirtIONet *n,
1035                                   struct iovec *out_cursor,
1036                                   struct iovec *in_cursor)
1037 {
1038     ssize_t r;
1039 
1040     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX)) {
1041         return 0;
1042     }
1043 
1044     /*
1045      * According to virtio_net_reset(), device turns promiscuous mode
1046      * on by default.
1047      *
1048      * Additionally, according to VirtIO standard, "Since there are
1049      * no guarantees, it can use a hash filter or silently switch to
1050      * allmulti or promiscuous mode if it is given too many addresses.".
1051      * QEMU marks `n->mac_table.uni_overflow` if guest sets too many
1052      * non-multicast MAC addresses, indicating that promiscuous mode
1053      * should be enabled.
1054      *
1055      * Therefore, QEMU should only send this CVQ command if the
1056      * `n->mac_table.uni_overflow` is not marked and `n->promisc` is off,
1057      * which sets promiscuous mode on, different from the device's defaults.
1058      *
1059      * Note that the device's defaults can mismatch the driver's
1060      * configuration only at live migration.
1061      */
1062     if (!n->mac_table.uni_overflow && !n->promisc) {
1063         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1064                                         VIRTIO_NET_CTRL_RX_PROMISC, 0);
1065         if (unlikely(r < 0)) {
1066             return r;
1067         }
1068     }
1069 
1070     /*
1071      * According to virtio_net_reset(), device turns all-multicast mode
1072      * off by default.
1073      *
1074      * According to VirtIO standard, "Since there are no guarantees,
1075      * it can use a hash filter or silently switch to allmulti or
1076      * promiscuous mode if it is given too many addresses.". QEMU marks
1077      * `n->mac_table.multi_overflow` if guest sets too many
1078      * non-multicast MAC addresses.
1079      *
1080      * Therefore, QEMU should only send this CVQ command if the
1081      * `n->mac_table.multi_overflow` is marked or `n->allmulti` is on,
1082      * which sets all-multicast mode on, different from the device's defaults.
1083      *
1084      * Note that the device's defaults can mismatch the driver's
1085      * configuration only at live migration.
1086      */
1087     if (n->mac_table.multi_overflow || n->allmulti) {
1088         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1089                                         VIRTIO_NET_CTRL_RX_ALLMULTI, 1);
1090         if (unlikely(r < 0)) {
1091             return r;
1092         }
1093     }
1094 
1095     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX_EXTRA)) {
1096         return 0;
1097     }
1098 
1099     /*
1100      * According to virtio_net_reset(), device turns all-unicast mode
1101      * off by default.
1102      *
1103      * Therefore, QEMU should only send this CVQ command if the driver
1104      * sets all-unicast mode on, different from the device's defaults.
1105      *
1106      * Note that the device's defaults can mismatch the driver's
1107      * configuration only at live migration.
1108      */
1109     if (n->alluni) {
1110         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1111                                         VIRTIO_NET_CTRL_RX_ALLUNI, 1);
1112         if (r < 0) {
1113             return r;
1114         }
1115     }
1116 
1117     /*
1118      * According to virtio_net_reset(), device turns non-multicast mode
1119      * off by default.
1120      *
1121      * Therefore, QEMU should only send this CVQ command if the driver
1122      * sets non-multicast mode on, different from the device's defaults.
1123      *
1124      * Note that the device's defaults can mismatch the driver's
1125      * configuration only at live migration.
1126      */
1127     if (n->nomulti) {
1128         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1129                                         VIRTIO_NET_CTRL_RX_NOMULTI, 1);
1130         if (r < 0) {
1131             return r;
1132         }
1133     }
1134 
1135     /*
1136      * According to virtio_net_reset(), device turns non-unicast mode
1137      * off by default.
1138      *
1139      * Therefore, QEMU should only send this CVQ command if the driver
1140      * sets non-unicast mode on, different from the device's defaults.
1141      *
1142      * Note that the device's defaults can mismatch the driver's
1143      * configuration only at live migration.
1144      */
1145     if (n->nouni) {
1146         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1147                                         VIRTIO_NET_CTRL_RX_NOUNI, 1);
1148         if (r < 0) {
1149             return r;
1150         }
1151     }
1152 
1153     /*
1154      * According to virtio_net_reset(), device turns non-broadcast mode
1155      * off by default.
1156      *
1157      * Therefore, QEMU should only send this CVQ command if the driver
1158      * sets non-broadcast mode on, different from the device's defaults.
1159      *
1160      * Note that the device's defaults can mismatch the driver's
1161      * configuration only at live migration.
1162      */
1163     if (n->nobcast) {
1164         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1165                                         VIRTIO_NET_CTRL_RX_NOBCAST, 1);
1166         if (r < 0) {
1167             return r;
1168         }
1169     }
1170 
1171     return 0;
1172 }
1173 
1174 static int vhost_vdpa_net_load_single_vlan(VhostVDPAState *s,
1175                                            const VirtIONet *n,
1176                                            struct iovec *out_cursor,
1177                                            struct iovec *in_cursor,
1178                                            uint16_t vid)
1179 {
1180     const struct iovec data = {
1181         .iov_base = &vid,
1182         .iov_len = sizeof(vid),
1183     };
1184     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1185                                         VIRTIO_NET_CTRL_VLAN,
1186                                         VIRTIO_NET_CTRL_VLAN_ADD,
1187                                         &data, 1);
1188     if (unlikely(r < 0)) {
1189         return r;
1190     }
1191 
1192     return 0;
1193 }
1194 
1195 static int vhost_vdpa_net_load_vlan(VhostVDPAState *s,
1196                                     const VirtIONet *n,
1197                                     struct iovec *out_cursor,
1198                                     struct iovec *in_cursor)
1199 {
1200     int r;
1201 
1202     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_VLAN)) {
1203         return 0;
1204     }
1205 
1206     for (int i = 0; i < MAX_VLAN >> 5; i++) {
1207         for (int j = 0; n->vlans[i] && j <= 0x1f; j++) {
1208             if (n->vlans[i] & (1U << j)) {
1209                 r = vhost_vdpa_net_load_single_vlan(s, n, out_cursor,
1210                                                     in_cursor, (i << 5) + j);
1211                 if (unlikely(r != 0)) {
1212                     return r;
1213                 }
1214             }
1215         }
1216     }
1217 
1218     return 0;
1219 }
1220 
1221 static int vhost_vdpa_net_cvq_load(NetClientState *nc)
1222 {
1223     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
1224     struct vhost_vdpa *v = &s->vhost_vdpa;
1225     const VirtIONet *n;
1226     int r;
1227     struct iovec out_cursor, in_cursor;
1228 
1229     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1230 
1231     r = vhost_vdpa_set_vring_ready(v, v->dev->vq_index);
1232     if (unlikely(r < 0)) {
1233         return r;
1234     }
1235 
1236     if (v->shadow_vqs_enabled) {
1237         n = VIRTIO_NET(v->dev->vdev);
1238         vhost_vdpa_net_load_cursor_reset(s, &out_cursor, &in_cursor);
1239         r = vhost_vdpa_net_load_mac(s, n, &out_cursor, &in_cursor);
1240         if (unlikely(r < 0)) {
1241             return r;
1242         }
1243         r = vhost_vdpa_net_load_mq(s, n, &out_cursor, &in_cursor);
1244         if (unlikely(r)) {
1245             return r;
1246         }
1247         r = vhost_vdpa_net_load_offloads(s, n, &out_cursor, &in_cursor);
1248         if (unlikely(r)) {
1249             return r;
1250         }
1251         r = vhost_vdpa_net_load_rx(s, n, &out_cursor, &in_cursor);
1252         if (unlikely(r)) {
1253             return r;
1254         }
1255         r = vhost_vdpa_net_load_vlan(s, n, &out_cursor, &in_cursor);
1256         if (unlikely(r)) {
1257             return r;
1258         }
1259 
1260         /*
1261          * We need to poll and check all pending device's used buffers.
1262          *
1263          * We can poll here since we've had BQL from the time
1264          * we sent the descriptor.
1265          */
1266         r = vhost_vdpa_net_svq_flush(s, in_cursor.iov_base - (void *)s->status);
1267         if (unlikely(r)) {
1268             return r;
1269         }
1270     }
1271 
1272     for (int i = 0; i < v->dev->vq_index; ++i) {
1273         r = vhost_vdpa_set_vring_ready(v, i);
1274         if (unlikely(r < 0)) {
1275             return r;
1276         }
1277     }
1278 
1279     return 0;
1280 }
1281 
1282 static NetClientInfo net_vhost_vdpa_cvq_info = {
1283     .type = NET_CLIENT_DRIVER_VHOST_VDPA,
1284     .size = sizeof(VhostVDPAState),
1285     .receive = vhost_vdpa_receive,
1286     .start = vhost_vdpa_net_cvq_start,
1287     .load = vhost_vdpa_net_cvq_load,
1288     .stop = vhost_vdpa_net_cvq_stop,
1289     .cleanup = vhost_vdpa_cleanup,
1290     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
1291     .has_ufo = vhost_vdpa_has_ufo,
1292     .check_peer_type = vhost_vdpa_check_peer_type,
1293     .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
1294     .get_vhost_net = vhost_vdpa_get_vhost_net,
1295 };
1296 
1297 /*
1298  * Forward the excessive VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command to
1299  * vdpa device.
1300  *
1301  * Considering that QEMU cannot send the entire filter table to the
1302  * vdpa device, it should send the VIRTIO_NET_CTRL_RX_PROMISC CVQ
1303  * command to enable promiscuous mode to receive all packets,
1304  * according to VirtIO standard, "Since there are no guarantees,
1305  * it can use a hash filter or silently switch to allmulti or
1306  * promiscuous mode if it is given too many addresses.".
1307  *
1308  * Since QEMU ignores MAC addresses beyond `MAC_TABLE_ENTRIES` and
1309  * marks `n->mac_table.x_overflow` accordingly, it should have
1310  * the same effect on the device model to receive
1311  * (`MAC_TABLE_ENTRIES` + 1) or more non-multicast MAC addresses.
1312  * The same applies to multicast MAC addresses.
1313  *
1314  * Therefore, QEMU can provide the device model with a fake
1315  * VIRTIO_NET_CTRL_MAC_TABLE_SET command with (`MAC_TABLE_ENTRIES` + 1)
1316  * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1) multicast
1317  * MAC addresses. This ensures that the device model marks
1318  * `n->mac_table.uni_overflow` and `n->mac_table.multi_overflow`,
1319  * allowing all packets to be received, which aligns with the
1320  * state of the vdpa device.
1321  */
1322 static int vhost_vdpa_net_excessive_mac_filter_cvq_add(VhostVDPAState *s,
1323                                                        VirtQueueElement *elem,
1324                                                        struct iovec *out,
1325                                                        const struct iovec *in)
1326 {
1327     struct virtio_net_ctrl_mac mac_data, *mac_ptr;
1328     struct virtio_net_ctrl_hdr *hdr_ptr;
1329     uint32_t cursor;
1330     ssize_t r;
1331     uint8_t on = 1;
1332 
1333     /* parse the non-multicast MAC address entries from CVQ command */
1334     cursor = sizeof(*hdr_ptr);
1335     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1336                    &mac_data, sizeof(mac_data));
1337     if (unlikely(r != sizeof(mac_data))) {
1338         /*
1339          * If the CVQ command is invalid, we should simulate the vdpa device
1340          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1341          */
1342         *s->status = VIRTIO_NET_ERR;
1343         return sizeof(*s->status);
1344     }
1345     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1346 
1347     /* parse the multicast MAC address entries from CVQ command */
1348     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1349                    &mac_data, sizeof(mac_data));
1350     if (r != sizeof(mac_data)) {
1351         /*
1352          * If the CVQ command is invalid, we should simulate the vdpa device
1353          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1354          */
1355         *s->status = VIRTIO_NET_ERR;
1356         return sizeof(*s->status);
1357     }
1358     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1359 
1360     /* validate the CVQ command */
1361     if (iov_size(elem->out_sg, elem->out_num) != cursor) {
1362         /*
1363          * If the CVQ command is invalid, we should simulate the vdpa device
1364          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1365          */
1366         *s->status = VIRTIO_NET_ERR;
1367         return sizeof(*s->status);
1368     }
1369 
1370     /*
1371      * According to VirtIO standard, "Since there are no guarantees,
1372      * it can use a hash filter or silently switch to allmulti or
1373      * promiscuous mode if it is given too many addresses.".
1374      *
1375      * Therefore, considering that QEMU is unable to send the entire
1376      * filter table to the vdpa device, it should send the
1377      * VIRTIO_NET_CTRL_RX_PROMISC CVQ command to enable promiscuous mode
1378      */
1379     hdr_ptr = out->iov_base;
1380     out->iov_len = sizeof(*hdr_ptr) + sizeof(on);
1381 
1382     hdr_ptr->class = VIRTIO_NET_CTRL_RX;
1383     hdr_ptr->cmd = VIRTIO_NET_CTRL_RX_PROMISC;
1384     iov_from_buf(out, 1, sizeof(*hdr_ptr), &on, sizeof(on));
1385     r = vhost_vdpa_net_cvq_add(s, out, 1, in, 1);
1386     if (unlikely(r < 0)) {
1387         return r;
1388     }
1389 
1390     /*
1391      * We can poll here since we've had BQL from the time
1392      * we sent the descriptor.
1393      */
1394     r = vhost_vdpa_net_svq_poll(s, 1);
1395     if (unlikely(r < sizeof(*s->status))) {
1396         return r;
1397     }
1398     if (*s->status != VIRTIO_NET_OK) {
1399         return sizeof(*s->status);
1400     }
1401 
1402     /*
1403      * QEMU should also send a fake VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ
1404      * command to the device model, including (`MAC_TABLE_ENTRIES` + 1)
1405      * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1)
1406      * multicast MAC addresses.
1407      *
1408      * By doing so, the device model can mark `n->mac_table.uni_overflow`
1409      * and `n->mac_table.multi_overflow`, enabling all packets to be
1410      * received, which aligns with the state of the vdpa device.
1411      */
1412     cursor = 0;
1413     uint32_t fake_uni_entries = MAC_TABLE_ENTRIES + 1,
1414              fake_mul_entries = MAC_TABLE_ENTRIES + 1,
1415              fake_cvq_size = sizeof(struct virtio_net_ctrl_hdr) +
1416                              sizeof(mac_data) + fake_uni_entries * ETH_ALEN +
1417                              sizeof(mac_data) + fake_mul_entries * ETH_ALEN;
1418 
1419     assert(fake_cvq_size < vhost_vdpa_net_cvq_cmd_page_len());
1420     out->iov_len = fake_cvq_size;
1421 
1422     /* pack the header for fake CVQ command */
1423     hdr_ptr = out->iov_base + cursor;
1424     hdr_ptr->class = VIRTIO_NET_CTRL_MAC;
1425     hdr_ptr->cmd = VIRTIO_NET_CTRL_MAC_TABLE_SET;
1426     cursor += sizeof(*hdr_ptr);
1427 
1428     /*
1429      * Pack the non-multicast MAC addresses part for fake CVQ command.
1430      *
1431      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1432      * addresses provided in CVQ command. Therefore, only the entries
1433      * field need to be prepared in the CVQ command.
1434      */
1435     mac_ptr = out->iov_base + cursor;
1436     mac_ptr->entries = cpu_to_le32(fake_uni_entries);
1437     cursor += sizeof(*mac_ptr) + fake_uni_entries * ETH_ALEN;
1438 
1439     /*
1440      * Pack the multicast MAC addresses part for fake CVQ command.
1441      *
1442      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1443      * addresses provided in CVQ command. Therefore, only the entries
1444      * field need to be prepared in the CVQ command.
1445      */
1446     mac_ptr = out->iov_base + cursor;
1447     mac_ptr->entries = cpu_to_le32(fake_mul_entries);
1448 
1449     /*
1450      * Simulating QEMU poll a vdpa device used buffer
1451      * for VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1452      */
1453     return sizeof(*s->status);
1454 }
1455 
1456 /**
1457  * Validate and copy control virtqueue commands.
1458  *
1459  * Following QEMU guidelines, we offer a copy of the buffers to the device to
1460  * prevent TOCTOU bugs.
1461  */
1462 static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
1463                                             VirtQueueElement *elem,
1464                                             void *opaque)
1465 {
1466     VhostVDPAState *s = opaque;
1467     size_t in_len;
1468     const struct virtio_net_ctrl_hdr *ctrl;
1469     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
1470     /* Out buffer sent to both the vdpa device and the device model */
1471     struct iovec out = {
1472         .iov_base = s->cvq_cmd_out_buffer,
1473     };
1474     /* in buffer used for device model */
1475     const struct iovec model_in = {
1476         .iov_base = &status,
1477         .iov_len = sizeof(status),
1478     };
1479     /* in buffer used for vdpa device */
1480     const struct iovec vdpa_in = {
1481         .iov_base = s->status,
1482         .iov_len = sizeof(*s->status),
1483     };
1484     ssize_t dev_written = -EINVAL;
1485 
1486     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
1487                              s->cvq_cmd_out_buffer,
1488                              vhost_vdpa_net_cvq_cmd_page_len());
1489 
1490     ctrl = s->cvq_cmd_out_buffer;
1491     if (ctrl->class == VIRTIO_NET_CTRL_ANNOUNCE) {
1492         /*
1493          * Guest announce capability is emulated by qemu, so don't forward to
1494          * the device.
1495          */
1496         dev_written = sizeof(status);
1497         *s->status = VIRTIO_NET_OK;
1498     } else if (unlikely(ctrl->class == VIRTIO_NET_CTRL_MAC &&
1499                         ctrl->cmd == VIRTIO_NET_CTRL_MAC_TABLE_SET &&
1500                         iov_size(elem->out_sg, elem->out_num) > out.iov_len)) {
1501         /*
1502          * Due to the size limitation of the out buffer sent to the vdpa device,
1503          * which is determined by vhost_vdpa_net_cvq_cmd_page_len(), excessive
1504          * MAC addresses set by the driver for the filter table can cause
1505          * truncation of the CVQ command in QEMU. As a result, the vdpa device
1506          * rejects the flawed CVQ command.
1507          *
1508          * Therefore, QEMU must handle this situation instead of sending
1509          * the CVQ command directly.
1510          */
1511         dev_written = vhost_vdpa_net_excessive_mac_filter_cvq_add(s, elem,
1512                                                             &out, &vdpa_in);
1513         if (unlikely(dev_written < 0)) {
1514             goto out;
1515         }
1516     } else {
1517         ssize_t r;
1518         r = vhost_vdpa_net_cvq_add(s, &out, 1, &vdpa_in, 1);
1519         if (unlikely(r < 0)) {
1520             dev_written = r;
1521             goto out;
1522         }
1523 
1524         /*
1525          * We can poll here since we've had BQL from the time
1526          * we sent the descriptor.
1527          */
1528         dev_written = vhost_vdpa_net_svq_poll(s, 1);
1529     }
1530 
1531     if (unlikely(dev_written < sizeof(status))) {
1532         error_report("Insufficient written data (%zu)", dev_written);
1533         goto out;
1534     }
1535 
1536     if (*s->status != VIRTIO_NET_OK) {
1537         goto out;
1538     }
1539 
1540     status = VIRTIO_NET_ERR;
1541     virtio_net_handle_ctrl_iov(svq->vdev, &model_in, 1, &out, 1);
1542     if (status != VIRTIO_NET_OK) {
1543         error_report("Bad CVQ processing in model");
1544     }
1545 
1546 out:
1547     in_len = iov_from_buf(elem->in_sg, elem->in_num, 0, &status,
1548                           sizeof(status));
1549     if (unlikely(in_len < sizeof(status))) {
1550         error_report("Bad device CVQ written length");
1551     }
1552     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
1553     /*
1554      * `elem` belongs to vhost_vdpa_net_handle_ctrl_avail() only when
1555      * the function successfully forwards the CVQ command, indicated
1556      * by a non-negative value of `dev_written`. Otherwise, it still
1557      * belongs to SVQ.
1558      * This function should only free the `elem` when it owns.
1559      */
1560     if (dev_written >= 0) {
1561         g_free(elem);
1562     }
1563     return dev_written < 0 ? dev_written : 0;
1564 }
1565 
1566 static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
1567     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
1568 };
1569 
1570 /**
1571  * Probe if CVQ is isolated
1572  *
1573  * @device_fd         The vdpa device fd
1574  * @features          Features offered by the device.
1575  * @cvq_index         The control vq pair index
1576  *
1577  * Returns <0 in case of failure, 0 if false and 1 if true.
1578  */
1579 static int vhost_vdpa_probe_cvq_isolation(int device_fd, uint64_t features,
1580                                           int cvq_index, Error **errp)
1581 {
1582     ERRP_GUARD();
1583     uint64_t backend_features;
1584     int64_t cvq_group;
1585     uint8_t status = VIRTIO_CONFIG_S_ACKNOWLEDGE |
1586                      VIRTIO_CONFIG_S_DRIVER;
1587     int r;
1588 
1589     r = ioctl(device_fd, VHOST_GET_BACKEND_FEATURES, &backend_features);
1590     if (unlikely(r < 0)) {
1591         error_setg_errno(errp, errno, "Cannot get vdpa backend_features");
1592         return r;
1593     }
1594 
1595     if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID))) {
1596         return 0;
1597     }
1598 
1599     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1600     if (unlikely(r)) {
1601         error_setg_errno(errp, -r, "Cannot set device status");
1602         goto out;
1603     }
1604 
1605     r = ioctl(device_fd, VHOST_SET_FEATURES, &features);
1606     if (unlikely(r)) {
1607         error_setg_errno(errp, -r, "Cannot set features");
1608         goto out;
1609     }
1610 
1611     status |= VIRTIO_CONFIG_S_FEATURES_OK;
1612     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1613     if (unlikely(r)) {
1614         error_setg_errno(errp, -r, "Cannot set device status");
1615         goto out;
1616     }
1617 
1618     cvq_group = vhost_vdpa_get_vring_group(device_fd, cvq_index, errp);
1619     if (unlikely(cvq_group < 0)) {
1620         if (cvq_group != -ENOTSUP) {
1621             r = cvq_group;
1622             goto out;
1623         }
1624 
1625         /*
1626          * The kernel report VHOST_BACKEND_F_IOTLB_ASID if the vdpa frontend
1627          * support ASID even if the parent driver does not.  The CVQ cannot be
1628          * isolated in this case.
1629          */
1630         error_free(*errp);
1631         *errp = NULL;
1632         r = 0;
1633         goto out;
1634     }
1635 
1636     for (int i = 0; i < cvq_index; ++i) {
1637         int64_t group = vhost_vdpa_get_vring_group(device_fd, i, errp);
1638         if (unlikely(group < 0)) {
1639             r = group;
1640             goto out;
1641         }
1642 
1643         if (group == (int64_t)cvq_group) {
1644             r = 0;
1645             goto out;
1646         }
1647     }
1648 
1649     r = 1;
1650 
1651 out:
1652     status = 0;
1653     ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1654     return r;
1655 }
1656 
1657 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
1658                                        const char *device,
1659                                        const char *name,
1660                                        int vdpa_device_fd,
1661                                        int queue_pair_index,
1662                                        int nvqs,
1663                                        bool is_datapath,
1664                                        bool svq,
1665                                        struct vhost_vdpa_iova_range iova_range,
1666                                        uint64_t features,
1667                                        VhostVDPAShared *shared,
1668                                        Error **errp)
1669 {
1670     NetClientState *nc = NULL;
1671     VhostVDPAState *s;
1672     int ret = 0;
1673     assert(name);
1674     int cvq_isolated = 0;
1675 
1676     if (is_datapath) {
1677         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
1678                                  name);
1679     } else {
1680         cvq_isolated = vhost_vdpa_probe_cvq_isolation(vdpa_device_fd, features,
1681                                                       queue_pair_index * 2,
1682                                                       errp);
1683         if (unlikely(cvq_isolated < 0)) {
1684             return NULL;
1685         }
1686 
1687         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
1688                                          device, name);
1689     }
1690     qemu_set_info_str(nc, TYPE_VHOST_VDPA);
1691     s = DO_UPCAST(VhostVDPAState, nc, nc);
1692 
1693     s->vhost_vdpa.index = queue_pair_index;
1694     s->always_svq = svq;
1695     s->migration_state.notify = NULL;
1696     s->vhost_vdpa.shadow_vqs_enabled = svq;
1697     if (queue_pair_index == 0) {
1698         vhost_vdpa_net_valid_svq_features(features,
1699                                           &s->vhost_vdpa.migration_blocker);
1700         s->vhost_vdpa.shared = g_new0(VhostVDPAShared, 1);
1701         s->vhost_vdpa.shared->device_fd = vdpa_device_fd;
1702         s->vhost_vdpa.shared->iova_range = iova_range;
1703         s->vhost_vdpa.shared->shadow_data = svq;
1704         s->vhost_vdpa.shared->iova_tree = vhost_iova_tree_new(iova_range.first,
1705                                                               iova_range.last);
1706     } else if (!is_datapath) {
1707         s->cvq_cmd_out_buffer = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1708                                      PROT_READ | PROT_WRITE,
1709                                      MAP_SHARED | MAP_ANONYMOUS, -1, 0);
1710         s->status = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1711                          PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS,
1712                          -1, 0);
1713 
1714         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
1715         s->vhost_vdpa.shadow_vq_ops_opaque = s;
1716         s->cvq_isolated = cvq_isolated;
1717     }
1718     if (queue_pair_index != 0) {
1719         s->vhost_vdpa.shared = shared;
1720     }
1721 
1722     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
1723     if (ret) {
1724         qemu_del_net_client(nc);
1725         return NULL;
1726     }
1727 
1728     return nc;
1729 }
1730 
1731 static int vhost_vdpa_get_features(int fd, uint64_t *features, Error **errp)
1732 {
1733     int ret = ioctl(fd, VHOST_GET_FEATURES, features);
1734     if (unlikely(ret < 0)) {
1735         error_setg_errno(errp, errno,
1736                          "Fail to query features from vhost-vDPA device");
1737     }
1738     return ret;
1739 }
1740 
1741 static int vhost_vdpa_get_max_queue_pairs(int fd, uint64_t features,
1742                                           int *has_cvq, Error **errp)
1743 {
1744     unsigned long config_size = offsetof(struct vhost_vdpa_config, buf);
1745     g_autofree struct vhost_vdpa_config *config = NULL;
1746     __virtio16 *max_queue_pairs;
1747     int ret;
1748 
1749     if (features & (1 << VIRTIO_NET_F_CTRL_VQ)) {
1750         *has_cvq = 1;
1751     } else {
1752         *has_cvq = 0;
1753     }
1754 
1755     if (features & (1 << VIRTIO_NET_F_MQ)) {
1756         config = g_malloc0(config_size + sizeof(*max_queue_pairs));
1757         config->off = offsetof(struct virtio_net_config, max_virtqueue_pairs);
1758         config->len = sizeof(*max_queue_pairs);
1759 
1760         ret = ioctl(fd, VHOST_VDPA_GET_CONFIG, config);
1761         if (ret) {
1762             error_setg(errp, "Fail to get config from vhost-vDPA device");
1763             return -ret;
1764         }
1765 
1766         max_queue_pairs = (__virtio16 *)&config->buf;
1767 
1768         return lduw_le_p(max_queue_pairs);
1769     }
1770 
1771     return 1;
1772 }
1773 
1774 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
1775                         NetClientState *peer, Error **errp)
1776 {
1777     ERRP_GUARD();
1778     const NetdevVhostVDPAOptions *opts;
1779     uint64_t features;
1780     int vdpa_device_fd;
1781     g_autofree NetClientState **ncs = NULL;
1782     struct vhost_vdpa_iova_range iova_range;
1783     NetClientState *nc;
1784     int queue_pairs, r, i = 0, has_cvq = 0;
1785 
1786     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1787     opts = &netdev->u.vhost_vdpa;
1788     if (!opts->vhostdev && !opts->vhostfd) {
1789         error_setg(errp,
1790                    "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
1791         return -1;
1792     }
1793 
1794     if (opts->vhostdev && opts->vhostfd) {
1795         error_setg(errp,
1796                    "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
1797         return -1;
1798     }
1799 
1800     if (opts->vhostdev) {
1801         vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
1802         if (vdpa_device_fd == -1) {
1803             return -errno;
1804         }
1805     } else {
1806         /* has_vhostfd */
1807         vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
1808         if (vdpa_device_fd == -1) {
1809             error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
1810             return -1;
1811         }
1812     }
1813 
1814     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
1815     if (unlikely(r < 0)) {
1816         goto err;
1817     }
1818 
1819     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
1820                                                  &has_cvq, errp);
1821     if (queue_pairs < 0) {
1822         qemu_close(vdpa_device_fd);
1823         return queue_pairs;
1824     }
1825 
1826     r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
1827     if (unlikely(r < 0)) {
1828         error_setg(errp, "vhost-vdpa: get iova range failed: %s",
1829                    strerror(-r));
1830         goto err;
1831     }
1832 
1833     if (opts->x_svq && !vhost_vdpa_net_valid_svq_features(features, errp)) {
1834         goto err;
1835     }
1836 
1837     ncs = g_malloc0(sizeof(*ncs) * queue_pairs);
1838 
1839     for (i = 0; i < queue_pairs; i++) {
1840         VhostVDPAShared *shared = NULL;
1841 
1842         if (i) {
1843             shared = DO_UPCAST(VhostVDPAState, nc, ncs[0])->vhost_vdpa.shared;
1844         }
1845         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1846                                      vdpa_device_fd, i, 2, true, opts->x_svq,
1847                                      iova_range, features, shared, errp);
1848         if (!ncs[i])
1849             goto err;
1850     }
1851 
1852     if (has_cvq) {
1853         VhostVDPAState *s0 = DO_UPCAST(VhostVDPAState, nc, ncs[0]);
1854         VhostVDPAShared *shared = s0->vhost_vdpa.shared;
1855 
1856         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1857                                  vdpa_device_fd, i, 1, false,
1858                                  opts->x_svq, iova_range, features, shared,
1859                                  errp);
1860         if (!nc)
1861             goto err;
1862     }
1863 
1864     return 0;
1865 
1866 err:
1867     if (i) {
1868         for (i--; i >= 0; i--) {
1869             qemu_del_net_client(ncs[i]);
1870         }
1871     }
1872 
1873     qemu_close(vdpa_device_fd);
1874 
1875     return -1;
1876 }
1877