xref: /openbmc/qemu/net/vhost-vdpa.c (revision 8f6e5c620a5b21c070eed93721236cad48b6f9d7)
1 /*
2  * vhost-vdpa.c
3  *
4  * Copyright(c) 2017-2018 Intel Corporation.
5  * Copyright(c) 2020 Red Hat, Inc.
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or later.
8  * See the COPYING file in the top-level directory.
9  *
10  */
11 
12 #include "qemu/osdep.h"
13 #include "clients.h"
14 #include "hw/virtio/virtio-net.h"
15 #include "net/vhost_net.h"
16 #include "net/vhost-vdpa.h"
17 #include "hw/virtio/vhost-vdpa.h"
18 #include "qemu/config-file.h"
19 #include "qemu/error-report.h"
20 #include "qemu/log.h"
21 #include "qemu/memalign.h"
22 #include "qemu/option.h"
23 #include "qapi/error.h"
24 #include <linux/vhost.h>
25 #include <sys/ioctl.h>
26 #include <err.h>
27 #include "standard-headers/linux/virtio_net.h"
28 #include "monitor/monitor.h"
29 #include "migration/misc.h"
30 #include "hw/virtio/vhost.h"
31 #include "trace.h"
32 
33 /* Todo:need to add the multiqueue support here */
34 typedef struct VhostVDPAState {
35     NetClientState nc;
36     struct vhost_vdpa vhost_vdpa;
37     NotifierWithReturn migration_state;
38     VHostNetState *vhost_net;
39 
40     /* Control commands shadow buffers */
41     void *cvq_cmd_out_buffer;
42     virtio_net_ctrl_ack *status;
43 
44     /* The device always have SVQ enabled */
45     bool always_svq;
46 
47     /* The device can isolate CVQ in its own ASID */
48     bool cvq_isolated;
49 
50     bool started;
51 } VhostVDPAState;
52 
53 /*
54  * The array is sorted alphabetically in ascending order,
55  * with the exception of VHOST_INVALID_FEATURE_BIT,
56  * which should always be the last entry.
57  */
58 const int vdpa_feature_bits[] = {
59     VIRTIO_F_ANY_LAYOUT,
60     VIRTIO_F_IOMMU_PLATFORM,
61     VIRTIO_F_NOTIFY_ON_EMPTY,
62     VIRTIO_F_RING_PACKED,
63     VIRTIO_F_RING_RESET,
64     VIRTIO_F_VERSION_1,
65     VIRTIO_F_IN_ORDER,
66     VIRTIO_F_NOTIFICATION_DATA,
67     VIRTIO_NET_F_CSUM,
68     VIRTIO_NET_F_CTRL_GUEST_OFFLOADS,
69     VIRTIO_NET_F_CTRL_MAC_ADDR,
70     VIRTIO_NET_F_CTRL_RX,
71     VIRTIO_NET_F_CTRL_RX_EXTRA,
72     VIRTIO_NET_F_CTRL_VLAN,
73     VIRTIO_NET_F_CTRL_VQ,
74     VIRTIO_NET_F_GSO,
75     VIRTIO_NET_F_GUEST_CSUM,
76     VIRTIO_NET_F_GUEST_ECN,
77     VIRTIO_NET_F_GUEST_TSO4,
78     VIRTIO_NET_F_GUEST_TSO6,
79     VIRTIO_NET_F_GUEST_UFO,
80     VIRTIO_NET_F_GUEST_USO4,
81     VIRTIO_NET_F_GUEST_USO6,
82     VIRTIO_NET_F_HASH_REPORT,
83     VIRTIO_NET_F_HOST_ECN,
84     VIRTIO_NET_F_HOST_TSO4,
85     VIRTIO_NET_F_HOST_TSO6,
86     VIRTIO_NET_F_HOST_UFO,
87     VIRTIO_NET_F_HOST_USO,
88     VIRTIO_NET_F_MQ,
89     VIRTIO_NET_F_MRG_RXBUF,
90     VIRTIO_NET_F_MTU,
91     VIRTIO_NET_F_RSC_EXT,
92     VIRTIO_NET_F_RSS,
93     VIRTIO_NET_F_STATUS,
94     VIRTIO_RING_F_EVENT_IDX,
95     VIRTIO_RING_F_INDIRECT_DESC,
96 
97     /* VHOST_INVALID_FEATURE_BIT should always be the last entry */
98     VHOST_INVALID_FEATURE_BIT
99 };
100 
101 /** Supported device specific feature bits with SVQ */
102 static const uint64_t vdpa_svq_device_features =
103     BIT_ULL(VIRTIO_NET_F_CSUM) |
104     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
105     BIT_ULL(VIRTIO_NET_F_CTRL_GUEST_OFFLOADS) |
106     BIT_ULL(VIRTIO_NET_F_MTU) |
107     BIT_ULL(VIRTIO_NET_F_MAC) |
108     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |
109     BIT_ULL(VIRTIO_NET_F_GUEST_TSO6) |
110     BIT_ULL(VIRTIO_NET_F_GUEST_ECN) |
111     BIT_ULL(VIRTIO_NET_F_GUEST_UFO) |
112     BIT_ULL(VIRTIO_NET_F_HOST_TSO4) |
113     BIT_ULL(VIRTIO_NET_F_HOST_TSO6) |
114     BIT_ULL(VIRTIO_NET_F_HOST_ECN) |
115     BIT_ULL(VIRTIO_NET_F_HOST_UFO) |
116     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
117     BIT_ULL(VIRTIO_NET_F_STATUS) |
118     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
119     BIT_ULL(VIRTIO_NET_F_CTRL_RX) |
120     BIT_ULL(VIRTIO_NET_F_CTRL_VLAN) |
121     BIT_ULL(VIRTIO_NET_F_CTRL_RX_EXTRA) |
122     BIT_ULL(VIRTIO_NET_F_MQ) |
123     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
124     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |
125     /* VHOST_F_LOG_ALL is exposed by SVQ */
126     BIT_ULL(VHOST_F_LOG_ALL) |
127     BIT_ULL(VIRTIO_NET_F_HASH_REPORT) |
128     BIT_ULL(VIRTIO_NET_F_RSS) |
129     BIT_ULL(VIRTIO_NET_F_RSC_EXT) |
130     BIT_ULL(VIRTIO_NET_F_STANDBY) |
131     BIT_ULL(VIRTIO_NET_F_SPEED_DUPLEX);
132 
133 #define VHOST_VDPA_NET_CVQ_ASID 1
134 
135 static struct vhost_net *vhost_vdpa_get_vhost_net(NetClientState *nc)
136 {
137     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
138     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
139     return s->vhost_net;
140 }
141 
142 static size_t vhost_vdpa_net_cvq_cmd_len(void)
143 {
144     /*
145      * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
146      * In buffer is always 1 byte, so it should fit here
147      */
148     return sizeof(struct virtio_net_ctrl_hdr) +
149            2 * sizeof(struct virtio_net_ctrl_mac) +
150            MAC_TABLE_ENTRIES * ETH_ALEN;
151 }
152 
153 static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
154 {
155     return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
156 }
157 
158 static bool vhost_vdpa_net_valid_svq_features(uint64_t features, Error **errp)
159 {
160     uint64_t invalid_dev_features =
161         features & ~vdpa_svq_device_features &
162         /* Transport are all accepted at this point */
163         ~MAKE_64BIT_MASK(VIRTIO_TRANSPORT_F_START,
164                          VIRTIO_TRANSPORT_F_END - VIRTIO_TRANSPORT_F_START);
165 
166     if (invalid_dev_features) {
167         error_setg(errp, "vdpa svq does not work with features 0x%" PRIx64,
168                    invalid_dev_features);
169         return false;
170     }
171 
172     return vhost_svq_valid_features(features, errp);
173 }
174 
175 static int vhost_vdpa_net_check_device_id(struct vhost_net *net)
176 {
177     uint32_t device_id;
178     int ret;
179     struct vhost_dev *hdev;
180 
181     hdev = (struct vhost_dev *)&net->dev;
182     ret = hdev->vhost_ops->vhost_get_device_id(hdev, &device_id);
183     if (device_id != VIRTIO_ID_NET) {
184         return -ENOTSUP;
185     }
186     return ret;
187 }
188 
189 static int vhost_vdpa_add(NetClientState *ncs, void *be,
190                           int queue_pair_index, int nvqs)
191 {
192     VhostNetOptions options;
193     struct vhost_net *net = NULL;
194     VhostVDPAState *s;
195     int ret;
196 
197     options.backend_type = VHOST_BACKEND_TYPE_VDPA;
198     assert(ncs->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
199     s = DO_UPCAST(VhostVDPAState, nc, ncs);
200     options.net_backend = ncs;
201     options.opaque      = be;
202     options.busyloop_timeout = 0;
203     options.nvqs = nvqs;
204 
205     net = vhost_net_init(&options);
206     if (!net) {
207         error_report("failed to init vhost_net for queue");
208         goto err_init;
209     }
210     s->vhost_net = net;
211     ret = vhost_vdpa_net_check_device_id(net);
212     if (ret) {
213         goto err_check;
214     }
215     return 0;
216 err_check:
217     vhost_net_cleanup(net);
218     g_free(net);
219 err_init:
220     return -1;
221 }
222 
223 static void vhost_vdpa_cleanup(NetClientState *nc)
224 {
225     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
226 
227     munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
228     munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
229     if (s->vhost_net) {
230         vhost_net_cleanup(s->vhost_net);
231         g_free(s->vhost_net);
232         s->vhost_net = NULL;
233     }
234     if (s->vhost_vdpa.index != 0) {
235         return;
236     }
237     qemu_close(s->vhost_vdpa.shared->device_fd);
238     g_clear_pointer(&s->vhost_vdpa.shared->iova_tree, vhost_iova_tree_delete);
239     g_free(s->vhost_vdpa.shared);
240 }
241 
242 /** Dummy SetSteeringEBPF to support RSS for vhost-vdpa backend  */
243 static bool vhost_vdpa_set_steering_ebpf(NetClientState *nc, int prog_fd)
244 {
245     return true;
246 }
247 
248 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
249 {
250     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
251 
252     return true;
253 }
254 
255 static bool vhost_vdpa_has_ufo(NetClientState *nc)
256 {
257     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
258     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
259     uint64_t features = 0;
260     features |= (1ULL << VIRTIO_NET_F_HOST_UFO);
261     features = vhost_net_get_features(s->vhost_net, features);
262     return !!(features & (1ULL << VIRTIO_NET_F_HOST_UFO));
263 
264 }
265 
266 /*
267  * FIXME: vhost_vdpa doesn't have an API to "set h/w endianness". But it's
268  * reasonable to assume that h/w is LE by default, because LE is what
269  * virtio 1.0 and later ask for. So, this function just says "yes, the h/w is
270  * LE". Otherwise, on a BE machine, higher-level code would mistakely think
271  * the h/w is BE and can't support VDPA for a virtio 1.0 client.
272  */
273 static int vhost_vdpa_set_vnet_le(NetClientState *nc, bool enable)
274 {
275     return 0;
276 }
277 
278 static bool vhost_vdpa_check_peer_type(NetClientState *nc, ObjectClass *oc,
279                                        Error **errp)
280 {
281     const char *driver = object_class_get_name(oc);
282 
283     if (!g_str_has_prefix(driver, "virtio-net-")) {
284         error_setg(errp, "vhost-vdpa requires frontend driver virtio-net-*");
285         return false;
286     }
287 
288     return true;
289 }
290 
291 /** Dummy receive in case qemu falls back to userland tap networking */
292 static ssize_t vhost_vdpa_receive(NetClientState *nc, const uint8_t *buf,
293                                   size_t size)
294 {
295     return size;
296 }
297 
298 
299 /** From any vdpa net client, get the netclient of the i-th queue pair */
300 static VhostVDPAState *vhost_vdpa_net_get_nc_vdpa(VhostVDPAState *s, int i)
301 {
302     NICState *nic = qemu_get_nic(s->nc.peer);
303     NetClientState *nc_i = qemu_get_peer(nic->ncs, i);
304 
305     return DO_UPCAST(VhostVDPAState, nc, nc_i);
306 }
307 
308 static VhostVDPAState *vhost_vdpa_net_first_nc_vdpa(VhostVDPAState *s)
309 {
310     return vhost_vdpa_net_get_nc_vdpa(s, 0);
311 }
312 
313 static void vhost_vdpa_net_log_global_enable(VhostVDPAState *s, bool enable)
314 {
315     struct vhost_vdpa *v = &s->vhost_vdpa;
316     VirtIONet *n;
317     VirtIODevice *vdev;
318     int data_queue_pairs, cvq, r;
319 
320     /* We are only called on the first data vqs and only if x-svq is not set */
321     if (s->vhost_vdpa.shadow_vqs_enabled == enable) {
322         return;
323     }
324 
325     vdev = v->dev->vdev;
326     n = VIRTIO_NET(vdev);
327     if (!n->vhost_started) {
328         return;
329     }
330 
331     data_queue_pairs = n->multiqueue ? n->max_queue_pairs : 1;
332     cvq = virtio_vdev_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) ?
333                                   n->max_ncs - n->max_queue_pairs : 0;
334     v->shared->svq_switching = enable ?
335         SVQ_TSTATE_ENABLING : SVQ_TSTATE_DISABLING;
336     /*
337      * TODO: vhost_net_stop does suspend, get_base and reset. We can be smarter
338      * in the future and resume the device if read-only operations between
339      * suspend and reset goes wrong.
340      */
341     vhost_net_stop(vdev, n->nic->ncs, data_queue_pairs, cvq);
342 
343     /* Start will check migration setup_or_active to configure or not SVQ */
344     r = vhost_net_start(vdev, n->nic->ncs, data_queue_pairs, cvq);
345     if (unlikely(r < 0)) {
346         error_report("unable to start vhost net: %s(%d)", g_strerror(-r), -r);
347     }
348     v->shared->svq_switching = SVQ_TSTATE_DONE;
349 }
350 
351 static int vdpa_net_migration_state_notifier(NotifierWithReturn *notifier,
352                                              MigrationEvent *e, Error **errp)
353 {
354     VhostVDPAState *s = container_of(notifier, VhostVDPAState, migration_state);
355 
356     if (e->type == MIG_EVENT_PRECOPY_SETUP) {
357         vhost_vdpa_net_log_global_enable(s, true);
358     } else if (e->type == MIG_EVENT_PRECOPY_FAILED) {
359         vhost_vdpa_net_log_global_enable(s, false);
360     }
361     return 0;
362 }
363 
364 static void vhost_vdpa_net_data_start_first(VhostVDPAState *s)
365 {
366     migration_add_notifier(&s->migration_state,
367                            vdpa_net_migration_state_notifier);
368 }
369 
370 static int vhost_vdpa_net_data_start(NetClientState *nc)
371 {
372     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
373     struct vhost_vdpa *v = &s->vhost_vdpa;
374 
375     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
376 
377     if (s->always_svq || migration_is_running()) {
378         v->shadow_vqs_enabled = true;
379     } else {
380         v->shadow_vqs_enabled = false;
381     }
382 
383     if (v->index == 0) {
384         v->shared->shadow_data = v->shadow_vqs_enabled;
385         vhost_vdpa_net_data_start_first(s);
386         return 0;
387     }
388 
389     return 0;
390 }
391 
392 static int vhost_vdpa_net_data_load(NetClientState *nc)
393 {
394     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
395     struct vhost_vdpa *v = &s->vhost_vdpa;
396     bool has_cvq = v->dev->vq_index_end % 2;
397 
398     if (has_cvq) {
399         return 0;
400     }
401 
402     for (int i = 0; i < v->dev->nvqs; ++i) {
403         int ret = vhost_vdpa_set_vring_ready(v, i + v->dev->vq_index);
404         if (ret < 0) {
405             return ret;
406         }
407     }
408     return 0;
409 }
410 
411 static void vhost_vdpa_net_client_stop(NetClientState *nc)
412 {
413     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
414 
415     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
416 
417     if (s->vhost_vdpa.index == 0) {
418         migration_remove_notifier(&s->migration_state);
419     }
420 }
421 
422 static NetClientInfo net_vhost_vdpa_info = {
423         .type = NET_CLIENT_DRIVER_VHOST_VDPA,
424         .size = sizeof(VhostVDPAState),
425         .receive = vhost_vdpa_receive,
426         .start = vhost_vdpa_net_data_start,
427         .load = vhost_vdpa_net_data_load,
428         .stop = vhost_vdpa_net_client_stop,
429         .cleanup = vhost_vdpa_cleanup,
430         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
431         .has_ufo = vhost_vdpa_has_ufo,
432         .set_vnet_le = vhost_vdpa_set_vnet_le,
433         .check_peer_type = vhost_vdpa_check_peer_type,
434         .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
435         .get_vhost_net = vhost_vdpa_get_vhost_net,
436 };
437 
438 static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
439                                           Error **errp)
440 {
441     struct vhost_vring_state state = {
442         .index = vq_index,
443     };
444     int r = ioctl(device_fd, VHOST_VDPA_GET_VRING_GROUP, &state);
445 
446     if (unlikely(r < 0)) {
447         r = -errno;
448         error_setg_errno(errp, errno, "Cannot get VQ %u group", vq_index);
449         return r;
450     }
451 
452     return state.num;
453 }
454 
455 static int vhost_vdpa_set_address_space_id(struct vhost_vdpa *v,
456                                            unsigned vq_group,
457                                            unsigned asid_num)
458 {
459     struct vhost_vring_state asid = {
460         .index = vq_group,
461         .num = asid_num,
462     };
463     int r;
464 
465     trace_vhost_vdpa_set_address_space_id(v, vq_group, asid_num);
466 
467     r = ioctl(v->shared->device_fd, VHOST_VDPA_SET_GROUP_ASID, &asid);
468     if (unlikely(r < 0)) {
469         error_report("Can't set vq group %u asid %u, errno=%d (%s)",
470                      asid.index, asid.num, errno, g_strerror(errno));
471     }
472     return r;
473 }
474 
475 static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
476 {
477     VhostIOVATree *tree = v->shared->iova_tree;
478     DMAMap needle = {
479         /*
480          * No need to specify size or to look for more translations since
481          * this contiguous chunk was allocated by us.
482          */
483         .translated_addr = (hwaddr)(uintptr_t)addr,
484     };
485     const DMAMap *map = vhost_iova_tree_find_iova(tree, &needle);
486     int r;
487 
488     if (unlikely(!map)) {
489         error_report("Cannot locate expected map");
490         return;
491     }
492 
493     r = vhost_vdpa_dma_unmap(v->shared, v->address_space_id, map->iova,
494                              map->size + 1);
495     if (unlikely(r != 0)) {
496         error_report("Device cannot unmap: %s(%d)", g_strerror(r), r);
497     }
498 
499     vhost_iova_tree_remove(tree, *map);
500 }
501 
502 /** Map CVQ buffer. */
503 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
504                                   bool write)
505 {
506     DMAMap map = {};
507     hwaddr taddr = (hwaddr)(uintptr_t)buf;
508     int r;
509 
510     map.size = size - 1;
511     map.perm = write ? IOMMU_RW : IOMMU_RO,
512     r = vhost_iova_tree_map_alloc(v->shared->iova_tree, &map, taddr);
513     if (unlikely(r != IOVA_OK)) {
514         error_report("Cannot map injected element");
515 
516         if (map.translated_addr == taddr) {
517             error_report("Insertion to IOVA->HVA tree failed");
518             /* Remove the mapping from the IOVA-only tree */
519             goto dma_map_err;
520         }
521         return r;
522     }
523 
524     r = vhost_vdpa_dma_map(v->shared, v->address_space_id, map.iova,
525                            vhost_vdpa_net_cvq_cmd_page_len(), buf, !write);
526     if (unlikely(r < 0)) {
527         goto dma_map_err;
528     }
529 
530     return 0;
531 
532 dma_map_err:
533     vhost_iova_tree_remove(v->shared->iova_tree, map);
534     return r;
535 }
536 
537 static int vhost_vdpa_net_cvq_start(NetClientState *nc)
538 {
539     VhostVDPAState *s, *s0;
540     struct vhost_vdpa *v;
541     int64_t cvq_group;
542     int r;
543     Error *err = NULL;
544 
545     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
546 
547     s = DO_UPCAST(VhostVDPAState, nc, nc);
548     v = &s->vhost_vdpa;
549 
550     s0 = vhost_vdpa_net_first_nc_vdpa(s);
551     v->shadow_vqs_enabled = s0->vhost_vdpa.shadow_vqs_enabled;
552     s->vhost_vdpa.address_space_id = VHOST_VDPA_GUEST_PA_ASID;
553 
554     if (v->shared->shadow_data) {
555         /* SVQ is already configured for all virtqueues */
556         goto out;
557     }
558 
559     /*
560      * If we early return in these cases SVQ will not be enabled. The migration
561      * will be blocked as long as vhost-vdpa backends will not offer _F_LOG.
562      */
563     if (!vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
564         return 0;
565     }
566 
567     if (!s->cvq_isolated) {
568         return 0;
569     }
570 
571     cvq_group = vhost_vdpa_get_vring_group(v->shared->device_fd,
572                                            v->dev->vq_index_end - 1,
573                                            &err);
574     if (unlikely(cvq_group < 0)) {
575         error_report_err(err);
576         return cvq_group;
577     }
578 
579     r = vhost_vdpa_set_address_space_id(v, cvq_group, VHOST_VDPA_NET_CVQ_ASID);
580     if (unlikely(r < 0)) {
581         return r;
582     }
583 
584     v->shadow_vqs_enabled = true;
585     s->vhost_vdpa.address_space_id = VHOST_VDPA_NET_CVQ_ASID;
586 
587 out:
588     if (!s->vhost_vdpa.shadow_vqs_enabled) {
589         return 0;
590     }
591 
592     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
593                                vhost_vdpa_net_cvq_cmd_page_len(), false);
594     if (unlikely(r < 0)) {
595         return r;
596     }
597 
598     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->status,
599                                vhost_vdpa_net_cvq_cmd_page_len(), true);
600     if (unlikely(r < 0)) {
601         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
602     }
603 
604     return r;
605 }
606 
607 static void vhost_vdpa_net_cvq_stop(NetClientState *nc)
608 {
609     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
610 
611     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
612 
613     if (s->vhost_vdpa.shadow_vqs_enabled) {
614         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
615         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->status);
616     }
617 
618     vhost_vdpa_net_client_stop(nc);
619 }
620 
621 static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s,
622                                     const struct iovec *out_sg, size_t out_num,
623                                     const struct iovec *in_sg, size_t in_num)
624 {
625     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
626     int r;
627 
628     r = vhost_svq_add(svq, out_sg, out_num, NULL, in_sg, in_num, NULL, NULL);
629     if (unlikely(r != 0)) {
630         if (unlikely(r == -ENOSPC)) {
631             qemu_log_mask(LOG_GUEST_ERROR, "%s: No space on device queue\n",
632                           __func__);
633         }
634     }
635 
636     return r;
637 }
638 
639 /*
640  * Convenience wrapper to poll SVQ for multiple control commands.
641  *
642  * Caller should hold the BQL when invoking this function, and should take
643  * the answer before SVQ pulls by itself when BQL is released.
644  */
645 static ssize_t vhost_vdpa_net_svq_poll(VhostVDPAState *s, size_t cmds_in_flight)
646 {
647     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
648     return vhost_svq_poll(svq, cmds_in_flight);
649 }
650 
651 static void vhost_vdpa_net_load_cursor_reset(VhostVDPAState *s,
652                                              struct iovec *out_cursor,
653                                              struct iovec *in_cursor)
654 {
655     /* reset the cursor of the output buffer for the device */
656     out_cursor->iov_base = s->cvq_cmd_out_buffer;
657     out_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
658 
659     /* reset the cursor of the in buffer for the device */
660     in_cursor->iov_base = s->status;
661     in_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
662 }
663 
664 /*
665  * Poll SVQ for multiple pending control commands and check the device's ack.
666  *
667  * Caller should hold the BQL when invoking this function.
668  *
669  * @s: The VhostVDPAState
670  * @len: The length of the pending status shadow buffer
671  */
672 static ssize_t vhost_vdpa_net_svq_flush(VhostVDPAState *s, size_t len)
673 {
674     /* device uses a one-byte length ack for each control command */
675     ssize_t dev_written = vhost_vdpa_net_svq_poll(s, len);
676     if (unlikely(dev_written != len)) {
677         return -EIO;
678     }
679 
680     /* check the device's ack */
681     for (int i = 0; i < len; ++i) {
682         if (s->status[i] != VIRTIO_NET_OK) {
683             return -EIO;
684         }
685     }
686     return 0;
687 }
688 
689 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s,
690                                        struct iovec *out_cursor,
691                                        struct iovec *in_cursor, uint8_t class,
692                                        uint8_t cmd, const struct iovec *data_sg,
693                                        size_t data_num)
694 {
695     const struct virtio_net_ctrl_hdr ctrl = {
696         .class = class,
697         .cmd = cmd,
698     };
699     size_t data_size = iov_size(data_sg, data_num), cmd_size;
700     struct iovec out, in;
701     ssize_t r;
702     unsigned dummy_cursor_iov_cnt;
703     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
704 
705     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
706     cmd_size = sizeof(ctrl) + data_size;
707     trace_vhost_vdpa_net_load_cmd(s, class, cmd, data_num, data_size);
708     if (vhost_svq_available_slots(svq) < 2 ||
709         iov_size(out_cursor, 1) < cmd_size) {
710         /*
711          * It is time to flush all pending control commands if SVQ is full
712          * or control commands shadow buffers are full.
713          *
714          * We can poll here since we've had BQL from the time
715          * we sent the descriptor.
716          */
717         r = vhost_vdpa_net_svq_flush(s, in_cursor->iov_base -
718                                      (void *)s->status);
719         if (unlikely(r < 0)) {
720             return r;
721         }
722 
723         vhost_vdpa_net_load_cursor_reset(s, out_cursor, in_cursor);
724     }
725 
726     /* pack the CVQ command header */
727     iov_from_buf(out_cursor, 1, 0, &ctrl, sizeof(ctrl));
728     /* pack the CVQ command command-specific-data */
729     iov_to_buf(data_sg, data_num, 0,
730                out_cursor->iov_base + sizeof(ctrl), data_size);
731 
732     /* extract the required buffer from the cursor for output */
733     iov_copy(&out, 1, out_cursor, 1, 0, cmd_size);
734     /* extract the required buffer from the cursor for input */
735     iov_copy(&in, 1, in_cursor, 1, 0, sizeof(*s->status));
736 
737     r = vhost_vdpa_net_cvq_add(s, &out, 1, &in, 1);
738     if (unlikely(r < 0)) {
739         trace_vhost_vdpa_net_load_cmd_retval(s, class, cmd, r);
740         return r;
741     }
742 
743     /* iterate the cursors */
744     dummy_cursor_iov_cnt = 1;
745     iov_discard_front(&out_cursor, &dummy_cursor_iov_cnt, cmd_size);
746     dummy_cursor_iov_cnt = 1;
747     iov_discard_front(&in_cursor, &dummy_cursor_iov_cnt, sizeof(*s->status));
748 
749     return 0;
750 }
751 
752 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n,
753                                    struct iovec *out_cursor,
754                                    struct iovec *in_cursor)
755 {
756     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
757         const struct iovec data = {
758             .iov_base = (void *)n->mac,
759             .iov_len = sizeof(n->mac),
760         };
761         ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
762                                             VIRTIO_NET_CTRL_MAC,
763                                             VIRTIO_NET_CTRL_MAC_ADDR_SET,
764                                             &data, 1);
765         if (unlikely(r < 0)) {
766             return r;
767         }
768     }
769 
770     /*
771      * According to VirtIO standard, "The device MUST have an
772      * empty MAC filtering table on reset.".
773      *
774      * Therefore, there is no need to send this CVQ command if the
775      * driver also sets an empty MAC filter table, which aligns with
776      * the device's defaults.
777      *
778      * Note that the device's defaults can mismatch the driver's
779      * configuration only at live migration.
780      */
781     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX) ||
782         n->mac_table.in_use == 0) {
783         return 0;
784     }
785 
786     uint32_t uni_entries = n->mac_table.first_multi,
787              uni_macs_size = uni_entries * ETH_ALEN,
788              mul_entries = n->mac_table.in_use - uni_entries,
789              mul_macs_size = mul_entries * ETH_ALEN;
790     struct virtio_net_ctrl_mac uni = {
791         .entries = cpu_to_le32(uni_entries),
792     };
793     struct virtio_net_ctrl_mac mul = {
794         .entries = cpu_to_le32(mul_entries),
795     };
796     const struct iovec data[] = {
797         {
798             .iov_base = &uni,
799             .iov_len = sizeof(uni),
800         }, {
801             .iov_base = n->mac_table.macs,
802             .iov_len = uni_macs_size,
803         }, {
804             .iov_base = &mul,
805             .iov_len = sizeof(mul),
806         }, {
807             .iov_base = &n->mac_table.macs[uni_macs_size],
808             .iov_len = mul_macs_size,
809         },
810     };
811     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
812                                         VIRTIO_NET_CTRL_MAC,
813                                         VIRTIO_NET_CTRL_MAC_TABLE_SET,
814                                         data, ARRAY_SIZE(data));
815     if (unlikely(r < 0)) {
816         return r;
817     }
818 
819     return 0;
820 }
821 
822 static int vhost_vdpa_net_load_rss(VhostVDPAState *s, const VirtIONet *n,
823                                    struct iovec *out_cursor,
824                                    struct iovec *in_cursor, bool do_rss)
825 {
826     struct virtio_net_rss_config cfg = {};
827     ssize_t r;
828     g_autofree uint16_t *table = NULL;
829 
830     /*
831      * According to VirtIO standard, "Initially the device has all hash
832      * types disabled and reports only VIRTIO_NET_HASH_REPORT_NONE.".
833      *
834      * Therefore, there is no need to send this CVQ command if the
835      * driver disables the all hash types, which aligns with
836      * the device's defaults.
837      *
838      * Note that the device's defaults can mismatch the driver's
839      * configuration only at live migration.
840      */
841     if (!n->rss_data.enabled ||
842         n->rss_data.hash_types == VIRTIO_NET_HASH_REPORT_NONE) {
843         return 0;
844     }
845 
846     table = g_malloc_n(n->rss_data.indirections_len,
847                        sizeof(n->rss_data.indirections_table[0]));
848     cfg.hash_types = cpu_to_le32(n->rss_data.hash_types);
849 
850     if (do_rss) {
851         /*
852          * According to VirtIO standard, "Number of entries in indirection_table
853          * is (indirection_table_mask + 1)".
854          */
855         cfg.indirection_table_mask = cpu_to_le16(n->rss_data.indirections_len -
856                                                  1);
857         cfg.unclassified_queue = cpu_to_le16(n->rss_data.default_queue);
858         for (int i = 0; i < n->rss_data.indirections_len; ++i) {
859             table[i] = cpu_to_le16(n->rss_data.indirections_table[i]);
860         }
861         cfg.max_tx_vq = cpu_to_le16(n->curr_queue_pairs);
862     } else {
863         /*
864          * According to VirtIO standard, "Field reserved MUST contain zeroes.
865          * It is defined to make the structure to match the layout of
866          * virtio_net_rss_config structure, defined in 5.1.6.5.7.".
867          *
868          * Therefore, we need to zero the fields in
869          * struct virtio_net_rss_config, which corresponds to the
870          * `reserved` field in struct virtio_net_hash_config.
871          *
872          * Note that all other fields are zeroed at their definitions,
873          * except for the `indirection_table` field, where the actual data
874          * is stored in the `table` variable to ensure compatibility
875          * with RSS case. Therefore, we need to zero the `table` variable here.
876          */
877         table[0] = 0;
878     }
879 
880     /*
881      * Considering that virtio_net_handle_rss() currently does not restore
882      * the hash key length parsed from the CVQ command sent from the guest
883      * into n->rss_data and uses the maximum key length in other code, so
884      * we also employ the maximum key length here.
885      */
886     cfg.hash_key_length = sizeof(n->rss_data.key);
887 
888     const struct iovec data[] = {
889         {
890             .iov_base = &cfg,
891             .iov_len = offsetof(struct virtio_net_rss_config,
892                                 indirection_table),
893         }, {
894             .iov_base = table,
895             .iov_len = n->rss_data.indirections_len *
896                        sizeof(n->rss_data.indirections_table[0]),
897         }, {
898             .iov_base = &cfg.max_tx_vq,
899             .iov_len = offsetof(struct virtio_net_rss_config, hash_key_data) -
900                        offsetof(struct virtio_net_rss_config, max_tx_vq),
901         }, {
902             .iov_base = (void *)n->rss_data.key,
903             .iov_len = sizeof(n->rss_data.key),
904         }
905     };
906 
907     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
908                                 VIRTIO_NET_CTRL_MQ,
909                                 do_rss ? VIRTIO_NET_CTRL_MQ_RSS_CONFIG :
910                                 VIRTIO_NET_CTRL_MQ_HASH_CONFIG,
911                                 data, ARRAY_SIZE(data));
912     if (unlikely(r < 0)) {
913         return r;
914     }
915 
916     return 0;
917 }
918 
919 static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
920                                   const VirtIONet *n,
921                                   struct iovec *out_cursor,
922                                   struct iovec *in_cursor)
923 {
924     struct virtio_net_ctrl_mq mq;
925     ssize_t r;
926 
927     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_MQ)) {
928         return 0;
929     }
930 
931     trace_vhost_vdpa_net_load_mq(s, n->curr_queue_pairs);
932 
933     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
934     const struct iovec data = {
935         .iov_base = &mq,
936         .iov_len = sizeof(mq),
937     };
938     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
939                                 VIRTIO_NET_CTRL_MQ,
940                                 VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET,
941                                 &data, 1);
942     if (unlikely(r < 0)) {
943         return r;
944     }
945 
946     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_RSS)) {
947         /* load the receive-side scaling state */
948         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, true);
949         if (unlikely(r < 0)) {
950             return r;
951         }
952     } else if (virtio_vdev_has_feature(&n->parent_obj,
953                                        VIRTIO_NET_F_HASH_REPORT)) {
954         /* load the hash calculation state */
955         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, false);
956         if (unlikely(r < 0)) {
957             return r;
958         }
959     }
960 
961     return 0;
962 }
963 
964 static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
965                                         const VirtIONet *n,
966                                         struct iovec *out_cursor,
967                                         struct iovec *in_cursor)
968 {
969     uint64_t offloads;
970     ssize_t r;
971 
972     if (!virtio_vdev_has_feature(&n->parent_obj,
973                                  VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) {
974         return 0;
975     }
976 
977     if (n->curr_guest_offloads == virtio_net_supported_guest_offloads(n)) {
978         /*
979          * According to VirtIO standard, "Upon feature negotiation
980          * corresponding offload gets enabled to preserve
981          * backward compatibility.".
982          *
983          * Therefore, there is no need to send this CVQ command if the
984          * driver also enables all supported offloads, which aligns with
985          * the device's defaults.
986          *
987          * Note that the device's defaults can mismatch the driver's
988          * configuration only at live migration.
989          */
990         return 0;
991     }
992 
993     offloads = cpu_to_le64(n->curr_guest_offloads);
994     const struct iovec data = {
995         .iov_base = &offloads,
996         .iov_len = sizeof(offloads),
997     };
998     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
999                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS,
1000                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET,
1001                                 &data, 1);
1002     if (unlikely(r < 0)) {
1003         return r;
1004     }
1005 
1006     return 0;
1007 }
1008 
1009 static int vhost_vdpa_net_load_rx_mode(VhostVDPAState *s,
1010                                        struct iovec *out_cursor,
1011                                        struct iovec *in_cursor,
1012                                        uint8_t cmd,
1013                                        uint8_t on)
1014 {
1015     const struct iovec data = {
1016         .iov_base = &on,
1017         .iov_len = sizeof(on),
1018     };
1019     ssize_t r;
1020 
1021     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1022                                 VIRTIO_NET_CTRL_RX, cmd, &data, 1);
1023     if (unlikely(r < 0)) {
1024         return r;
1025     }
1026 
1027     return 0;
1028 }
1029 
1030 static int vhost_vdpa_net_load_rx(VhostVDPAState *s,
1031                                   const VirtIONet *n,
1032                                   struct iovec *out_cursor,
1033                                   struct iovec *in_cursor)
1034 {
1035     ssize_t r;
1036 
1037     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX)) {
1038         return 0;
1039     }
1040 
1041     /*
1042      * According to virtio_net_reset(), device turns promiscuous mode
1043      * on by default.
1044      *
1045      * Additionally, according to VirtIO standard, "Since there are
1046      * no guarantees, it can use a hash filter or silently switch to
1047      * allmulti or promiscuous mode if it is given too many addresses.".
1048      * QEMU marks `n->mac_table.uni_overflow` if guest sets too many
1049      * non-multicast MAC addresses, indicating that promiscuous mode
1050      * should be enabled.
1051      *
1052      * Therefore, QEMU should only send this CVQ command if the
1053      * `n->mac_table.uni_overflow` is not marked and `n->promisc` is off,
1054      * which sets promiscuous mode on, different from the device's defaults.
1055      *
1056      * Note that the device's defaults can mismatch the driver's
1057      * configuration only at live migration.
1058      */
1059     if (!n->mac_table.uni_overflow && !n->promisc) {
1060         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1061                                         VIRTIO_NET_CTRL_RX_PROMISC, 0);
1062         if (unlikely(r < 0)) {
1063             return r;
1064         }
1065     }
1066 
1067     /*
1068      * According to virtio_net_reset(), device turns all-multicast mode
1069      * off by default.
1070      *
1071      * According to VirtIO standard, "Since there are no guarantees,
1072      * it can use a hash filter or silently switch to allmulti or
1073      * promiscuous mode if it is given too many addresses.". QEMU marks
1074      * `n->mac_table.multi_overflow` if guest sets too many
1075      * non-multicast MAC addresses.
1076      *
1077      * Therefore, QEMU should only send this CVQ command if the
1078      * `n->mac_table.multi_overflow` is marked or `n->allmulti` is on,
1079      * which sets all-multicast mode on, different from the device's defaults.
1080      *
1081      * Note that the device's defaults can mismatch the driver's
1082      * configuration only at live migration.
1083      */
1084     if (n->mac_table.multi_overflow || n->allmulti) {
1085         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1086                                         VIRTIO_NET_CTRL_RX_ALLMULTI, 1);
1087         if (unlikely(r < 0)) {
1088             return r;
1089         }
1090     }
1091 
1092     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX_EXTRA)) {
1093         return 0;
1094     }
1095 
1096     /*
1097      * According to virtio_net_reset(), device turns all-unicast mode
1098      * off by default.
1099      *
1100      * Therefore, QEMU should only send this CVQ command if the driver
1101      * sets all-unicast mode on, different from the device's defaults.
1102      *
1103      * Note that the device's defaults can mismatch the driver's
1104      * configuration only at live migration.
1105      */
1106     if (n->alluni) {
1107         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1108                                         VIRTIO_NET_CTRL_RX_ALLUNI, 1);
1109         if (r < 0) {
1110             return r;
1111         }
1112     }
1113 
1114     /*
1115      * According to virtio_net_reset(), device turns non-multicast mode
1116      * off by default.
1117      *
1118      * Therefore, QEMU should only send this CVQ command if the driver
1119      * sets non-multicast mode on, different from the device's defaults.
1120      *
1121      * Note that the device's defaults can mismatch the driver's
1122      * configuration only at live migration.
1123      */
1124     if (n->nomulti) {
1125         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1126                                         VIRTIO_NET_CTRL_RX_NOMULTI, 1);
1127         if (r < 0) {
1128             return r;
1129         }
1130     }
1131 
1132     /*
1133      * According to virtio_net_reset(), device turns non-unicast mode
1134      * off by default.
1135      *
1136      * Therefore, QEMU should only send this CVQ command if the driver
1137      * sets non-unicast mode on, different from the device's defaults.
1138      *
1139      * Note that the device's defaults can mismatch the driver's
1140      * configuration only at live migration.
1141      */
1142     if (n->nouni) {
1143         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1144                                         VIRTIO_NET_CTRL_RX_NOUNI, 1);
1145         if (r < 0) {
1146             return r;
1147         }
1148     }
1149 
1150     /*
1151      * According to virtio_net_reset(), device turns non-broadcast mode
1152      * off by default.
1153      *
1154      * Therefore, QEMU should only send this CVQ command if the driver
1155      * sets non-broadcast mode on, different from the device's defaults.
1156      *
1157      * Note that the device's defaults can mismatch the driver's
1158      * configuration only at live migration.
1159      */
1160     if (n->nobcast) {
1161         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1162                                         VIRTIO_NET_CTRL_RX_NOBCAST, 1);
1163         if (r < 0) {
1164             return r;
1165         }
1166     }
1167 
1168     return 0;
1169 }
1170 
1171 static int vhost_vdpa_net_load_single_vlan(VhostVDPAState *s,
1172                                            const VirtIONet *n,
1173                                            struct iovec *out_cursor,
1174                                            struct iovec *in_cursor,
1175                                            uint16_t vid)
1176 {
1177     const struct iovec data = {
1178         .iov_base = &vid,
1179         .iov_len = sizeof(vid),
1180     };
1181     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1182                                         VIRTIO_NET_CTRL_VLAN,
1183                                         VIRTIO_NET_CTRL_VLAN_ADD,
1184                                         &data, 1);
1185     if (unlikely(r < 0)) {
1186         return r;
1187     }
1188 
1189     return 0;
1190 }
1191 
1192 static int vhost_vdpa_net_load_vlan(VhostVDPAState *s,
1193                                     const VirtIONet *n,
1194                                     struct iovec *out_cursor,
1195                                     struct iovec *in_cursor)
1196 {
1197     int r;
1198 
1199     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_VLAN)) {
1200         return 0;
1201     }
1202 
1203     for (int i = 0; i < MAX_VLAN >> 5; i++) {
1204         for (int j = 0; n->vlans[i] && j <= 0x1f; j++) {
1205             if (n->vlans[i] & (1U << j)) {
1206                 r = vhost_vdpa_net_load_single_vlan(s, n, out_cursor,
1207                                                     in_cursor, (i << 5) + j);
1208                 if (unlikely(r != 0)) {
1209                     return r;
1210                 }
1211             }
1212         }
1213     }
1214 
1215     return 0;
1216 }
1217 
1218 static int vhost_vdpa_net_cvq_load(NetClientState *nc)
1219 {
1220     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
1221     struct vhost_vdpa *v = &s->vhost_vdpa;
1222     const VirtIONet *n;
1223     int r;
1224     struct iovec out_cursor, in_cursor;
1225 
1226     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1227 
1228     r = vhost_vdpa_set_vring_ready(v, v->dev->vq_index);
1229     if (unlikely(r < 0)) {
1230         return r;
1231     }
1232 
1233     if (v->shadow_vqs_enabled) {
1234         n = VIRTIO_NET(v->dev->vdev);
1235         vhost_vdpa_net_load_cursor_reset(s, &out_cursor, &in_cursor);
1236         r = vhost_vdpa_net_load_mac(s, n, &out_cursor, &in_cursor);
1237         if (unlikely(r < 0)) {
1238             return r;
1239         }
1240         r = vhost_vdpa_net_load_mq(s, n, &out_cursor, &in_cursor);
1241         if (unlikely(r)) {
1242             return r;
1243         }
1244         r = vhost_vdpa_net_load_offloads(s, n, &out_cursor, &in_cursor);
1245         if (unlikely(r)) {
1246             return r;
1247         }
1248         r = vhost_vdpa_net_load_rx(s, n, &out_cursor, &in_cursor);
1249         if (unlikely(r)) {
1250             return r;
1251         }
1252         r = vhost_vdpa_net_load_vlan(s, n, &out_cursor, &in_cursor);
1253         if (unlikely(r)) {
1254             return r;
1255         }
1256 
1257         /*
1258          * We need to poll and check all pending device's used buffers.
1259          *
1260          * We can poll here since we've had BQL from the time
1261          * we sent the descriptor.
1262          */
1263         r = vhost_vdpa_net_svq_flush(s, in_cursor.iov_base - (void *)s->status);
1264         if (unlikely(r)) {
1265             return r;
1266         }
1267     }
1268 
1269     for (int i = 0; i < v->dev->vq_index; ++i) {
1270         r = vhost_vdpa_set_vring_ready(v, i);
1271         if (unlikely(r < 0)) {
1272             return r;
1273         }
1274     }
1275 
1276     return 0;
1277 }
1278 
1279 static NetClientInfo net_vhost_vdpa_cvq_info = {
1280     .type = NET_CLIENT_DRIVER_VHOST_VDPA,
1281     .size = sizeof(VhostVDPAState),
1282     .receive = vhost_vdpa_receive,
1283     .start = vhost_vdpa_net_cvq_start,
1284     .load = vhost_vdpa_net_cvq_load,
1285     .stop = vhost_vdpa_net_cvq_stop,
1286     .cleanup = vhost_vdpa_cleanup,
1287     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
1288     .has_ufo = vhost_vdpa_has_ufo,
1289     .check_peer_type = vhost_vdpa_check_peer_type,
1290     .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
1291     .get_vhost_net = vhost_vdpa_get_vhost_net,
1292 };
1293 
1294 /*
1295  * Forward the excessive VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command to
1296  * vdpa device.
1297  *
1298  * Considering that QEMU cannot send the entire filter table to the
1299  * vdpa device, it should send the VIRTIO_NET_CTRL_RX_PROMISC CVQ
1300  * command to enable promiscuous mode to receive all packets,
1301  * according to VirtIO standard, "Since there are no guarantees,
1302  * it can use a hash filter or silently switch to allmulti or
1303  * promiscuous mode if it is given too many addresses.".
1304  *
1305  * Since QEMU ignores MAC addresses beyond `MAC_TABLE_ENTRIES` and
1306  * marks `n->mac_table.x_overflow` accordingly, it should have
1307  * the same effect on the device model to receive
1308  * (`MAC_TABLE_ENTRIES` + 1) or more non-multicast MAC addresses.
1309  * The same applies to multicast MAC addresses.
1310  *
1311  * Therefore, QEMU can provide the device model with a fake
1312  * VIRTIO_NET_CTRL_MAC_TABLE_SET command with (`MAC_TABLE_ENTRIES` + 1)
1313  * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1) multicast
1314  * MAC addresses. This ensures that the device model marks
1315  * `n->mac_table.uni_overflow` and `n->mac_table.multi_overflow`,
1316  * allowing all packets to be received, which aligns with the
1317  * state of the vdpa device.
1318  */
1319 static int vhost_vdpa_net_excessive_mac_filter_cvq_add(VhostVDPAState *s,
1320                                                        VirtQueueElement *elem,
1321                                                        struct iovec *out,
1322                                                        const struct iovec *in)
1323 {
1324     struct virtio_net_ctrl_mac mac_data, *mac_ptr;
1325     struct virtio_net_ctrl_hdr *hdr_ptr;
1326     uint32_t cursor;
1327     ssize_t r;
1328     uint8_t on = 1;
1329 
1330     /* parse the non-multicast MAC address entries from CVQ command */
1331     cursor = sizeof(*hdr_ptr);
1332     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1333                    &mac_data, sizeof(mac_data));
1334     if (unlikely(r != sizeof(mac_data))) {
1335         /*
1336          * If the CVQ command is invalid, we should simulate the vdpa device
1337          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1338          */
1339         *s->status = VIRTIO_NET_ERR;
1340         return sizeof(*s->status);
1341     }
1342     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1343 
1344     /* parse the multicast MAC address entries from CVQ command */
1345     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1346                    &mac_data, sizeof(mac_data));
1347     if (r != sizeof(mac_data)) {
1348         /*
1349          * If the CVQ command is invalid, we should simulate the vdpa device
1350          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1351          */
1352         *s->status = VIRTIO_NET_ERR;
1353         return sizeof(*s->status);
1354     }
1355     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1356 
1357     /* validate the CVQ command */
1358     if (iov_size(elem->out_sg, elem->out_num) != cursor) {
1359         /*
1360          * If the CVQ command is invalid, we should simulate the vdpa device
1361          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1362          */
1363         *s->status = VIRTIO_NET_ERR;
1364         return sizeof(*s->status);
1365     }
1366 
1367     /*
1368      * According to VirtIO standard, "Since there are no guarantees,
1369      * it can use a hash filter or silently switch to allmulti or
1370      * promiscuous mode if it is given too many addresses.".
1371      *
1372      * Therefore, considering that QEMU is unable to send the entire
1373      * filter table to the vdpa device, it should send the
1374      * VIRTIO_NET_CTRL_RX_PROMISC CVQ command to enable promiscuous mode
1375      */
1376     hdr_ptr = out->iov_base;
1377     out->iov_len = sizeof(*hdr_ptr) + sizeof(on);
1378 
1379     hdr_ptr->class = VIRTIO_NET_CTRL_RX;
1380     hdr_ptr->cmd = VIRTIO_NET_CTRL_RX_PROMISC;
1381     iov_from_buf(out, 1, sizeof(*hdr_ptr), &on, sizeof(on));
1382     r = vhost_vdpa_net_cvq_add(s, out, 1, in, 1);
1383     if (unlikely(r < 0)) {
1384         return r;
1385     }
1386 
1387     /*
1388      * We can poll here since we've had BQL from the time
1389      * we sent the descriptor.
1390      */
1391     r = vhost_vdpa_net_svq_poll(s, 1);
1392     if (unlikely(r < sizeof(*s->status))) {
1393         return r;
1394     }
1395     if (*s->status != VIRTIO_NET_OK) {
1396         return sizeof(*s->status);
1397     }
1398 
1399     /*
1400      * QEMU should also send a fake VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ
1401      * command to the device model, including (`MAC_TABLE_ENTRIES` + 1)
1402      * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1)
1403      * multicast MAC addresses.
1404      *
1405      * By doing so, the device model can mark `n->mac_table.uni_overflow`
1406      * and `n->mac_table.multi_overflow`, enabling all packets to be
1407      * received, which aligns with the state of the vdpa device.
1408      */
1409     cursor = 0;
1410     uint32_t fake_uni_entries = MAC_TABLE_ENTRIES + 1,
1411              fake_mul_entries = MAC_TABLE_ENTRIES + 1,
1412              fake_cvq_size = sizeof(struct virtio_net_ctrl_hdr) +
1413                              sizeof(mac_data) + fake_uni_entries * ETH_ALEN +
1414                              sizeof(mac_data) + fake_mul_entries * ETH_ALEN;
1415 
1416     assert(fake_cvq_size < vhost_vdpa_net_cvq_cmd_page_len());
1417     out->iov_len = fake_cvq_size;
1418 
1419     /* pack the header for fake CVQ command */
1420     hdr_ptr = out->iov_base + cursor;
1421     hdr_ptr->class = VIRTIO_NET_CTRL_MAC;
1422     hdr_ptr->cmd = VIRTIO_NET_CTRL_MAC_TABLE_SET;
1423     cursor += sizeof(*hdr_ptr);
1424 
1425     /*
1426      * Pack the non-multicast MAC addresses part for fake CVQ command.
1427      *
1428      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1429      * addresses provided in CVQ command. Therefore, only the entries
1430      * field need to be prepared in the CVQ command.
1431      */
1432     mac_ptr = out->iov_base + cursor;
1433     mac_ptr->entries = cpu_to_le32(fake_uni_entries);
1434     cursor += sizeof(*mac_ptr) + fake_uni_entries * ETH_ALEN;
1435 
1436     /*
1437      * Pack the multicast MAC addresses part for fake CVQ command.
1438      *
1439      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1440      * addresses provided in CVQ command. Therefore, only the entries
1441      * field need to be prepared in the CVQ command.
1442      */
1443     mac_ptr = out->iov_base + cursor;
1444     mac_ptr->entries = cpu_to_le32(fake_mul_entries);
1445 
1446     /*
1447      * Simulating QEMU poll a vdpa device used buffer
1448      * for VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1449      */
1450     return sizeof(*s->status);
1451 }
1452 
1453 /**
1454  * Validate and copy control virtqueue commands.
1455  *
1456  * Following QEMU guidelines, we offer a copy of the buffers to the device to
1457  * prevent TOCTOU bugs.
1458  */
1459 static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
1460                                             VirtQueueElement *elem,
1461                                             void *opaque)
1462 {
1463     VhostVDPAState *s = opaque;
1464     size_t in_len;
1465     const struct virtio_net_ctrl_hdr *ctrl;
1466     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
1467     /* Out buffer sent to both the vdpa device and the device model */
1468     struct iovec out = {
1469         .iov_base = s->cvq_cmd_out_buffer,
1470     };
1471     /* in buffer used for device model */
1472     const struct iovec model_in = {
1473         .iov_base = &status,
1474         .iov_len = sizeof(status),
1475     };
1476     /* in buffer used for vdpa device */
1477     const struct iovec vdpa_in = {
1478         .iov_base = s->status,
1479         .iov_len = sizeof(*s->status),
1480     };
1481     ssize_t dev_written = -EINVAL;
1482 
1483     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
1484                              s->cvq_cmd_out_buffer,
1485                              vhost_vdpa_net_cvq_cmd_page_len());
1486 
1487     ctrl = s->cvq_cmd_out_buffer;
1488     if (ctrl->class == VIRTIO_NET_CTRL_ANNOUNCE) {
1489         /*
1490          * Guest announce capability is emulated by qemu, so don't forward to
1491          * the device.
1492          */
1493         dev_written = sizeof(status);
1494         *s->status = VIRTIO_NET_OK;
1495     } else if (unlikely(ctrl->class == VIRTIO_NET_CTRL_MAC &&
1496                         ctrl->cmd == VIRTIO_NET_CTRL_MAC_TABLE_SET &&
1497                         iov_size(elem->out_sg, elem->out_num) > out.iov_len)) {
1498         /*
1499          * Due to the size limitation of the out buffer sent to the vdpa device,
1500          * which is determined by vhost_vdpa_net_cvq_cmd_page_len(), excessive
1501          * MAC addresses set by the driver for the filter table can cause
1502          * truncation of the CVQ command in QEMU. As a result, the vdpa device
1503          * rejects the flawed CVQ command.
1504          *
1505          * Therefore, QEMU must handle this situation instead of sending
1506          * the CVQ command directly.
1507          */
1508         dev_written = vhost_vdpa_net_excessive_mac_filter_cvq_add(s, elem,
1509                                                             &out, &vdpa_in);
1510         if (unlikely(dev_written < 0)) {
1511             goto out;
1512         }
1513     } else {
1514         ssize_t r;
1515         r = vhost_vdpa_net_cvq_add(s, &out, 1, &vdpa_in, 1);
1516         if (unlikely(r < 0)) {
1517             dev_written = r;
1518             goto out;
1519         }
1520 
1521         /*
1522          * We can poll here since we've had BQL from the time
1523          * we sent the descriptor.
1524          */
1525         dev_written = vhost_vdpa_net_svq_poll(s, 1);
1526     }
1527 
1528     if (unlikely(dev_written < sizeof(status))) {
1529         error_report("Insufficient written data (%zu)", dev_written);
1530         goto out;
1531     }
1532 
1533     if (*s->status != VIRTIO_NET_OK) {
1534         goto out;
1535     }
1536 
1537     status = VIRTIO_NET_ERR;
1538     virtio_net_handle_ctrl_iov(svq->vdev, &model_in, 1, &out, 1);
1539     if (status != VIRTIO_NET_OK) {
1540         error_report("Bad CVQ processing in model");
1541     }
1542 
1543 out:
1544     in_len = iov_from_buf(elem->in_sg, elem->in_num, 0, &status,
1545                           sizeof(status));
1546     if (unlikely(in_len < sizeof(status))) {
1547         error_report("Bad device CVQ written length");
1548     }
1549     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
1550     /*
1551      * `elem` belongs to vhost_vdpa_net_handle_ctrl_avail() only when
1552      * the function successfully forwards the CVQ command, indicated
1553      * by a non-negative value of `dev_written`. Otherwise, it still
1554      * belongs to SVQ.
1555      * This function should only free the `elem` when it owns.
1556      */
1557     if (dev_written >= 0) {
1558         g_free(elem);
1559     }
1560     return dev_written < 0 ? dev_written : 0;
1561 }
1562 
1563 static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
1564     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
1565 };
1566 
1567 /**
1568  * Probe if CVQ is isolated
1569  *
1570  * @device_fd         The vdpa device fd
1571  * @features          Features offered by the device.
1572  * @cvq_index         The control vq pair index
1573  *
1574  * Returns <0 in case of failure, 0 if false and 1 if true.
1575  */
1576 static int vhost_vdpa_probe_cvq_isolation(int device_fd, uint64_t features,
1577                                           int cvq_index, Error **errp)
1578 {
1579     ERRP_GUARD();
1580     uint64_t backend_features;
1581     int64_t cvq_group;
1582     uint8_t status = VIRTIO_CONFIG_S_ACKNOWLEDGE |
1583                      VIRTIO_CONFIG_S_DRIVER;
1584     int r;
1585 
1586     r = ioctl(device_fd, VHOST_GET_BACKEND_FEATURES, &backend_features);
1587     if (unlikely(r < 0)) {
1588         error_setg_errno(errp, errno, "Cannot get vdpa backend_features");
1589         return r;
1590     }
1591 
1592     if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID))) {
1593         return 0;
1594     }
1595 
1596     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1597     if (unlikely(r)) {
1598         error_setg_errno(errp, -r, "Cannot set device status");
1599         goto out;
1600     }
1601 
1602     r = ioctl(device_fd, VHOST_SET_FEATURES, &features);
1603     if (unlikely(r)) {
1604         error_setg_errno(errp, -r, "Cannot set features");
1605         goto out;
1606     }
1607 
1608     status |= VIRTIO_CONFIG_S_FEATURES_OK;
1609     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1610     if (unlikely(r)) {
1611         error_setg_errno(errp, -r, "Cannot set device status");
1612         goto out;
1613     }
1614 
1615     cvq_group = vhost_vdpa_get_vring_group(device_fd, cvq_index, errp);
1616     if (unlikely(cvq_group < 0)) {
1617         if (cvq_group != -ENOTSUP) {
1618             r = cvq_group;
1619             goto out;
1620         }
1621 
1622         /*
1623          * The kernel report VHOST_BACKEND_F_IOTLB_ASID if the vdpa frontend
1624          * support ASID even if the parent driver does not.  The CVQ cannot be
1625          * isolated in this case.
1626          */
1627         error_free(*errp);
1628         *errp = NULL;
1629         r = 0;
1630         goto out;
1631     }
1632 
1633     for (int i = 0; i < cvq_index; ++i) {
1634         int64_t group = vhost_vdpa_get_vring_group(device_fd, i, errp);
1635         if (unlikely(group < 0)) {
1636             r = group;
1637             goto out;
1638         }
1639 
1640         if (group == (int64_t)cvq_group) {
1641             r = 0;
1642             goto out;
1643         }
1644     }
1645 
1646     r = 1;
1647 
1648 out:
1649     status = 0;
1650     ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1651     return r;
1652 }
1653 
1654 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
1655                                        const char *device,
1656                                        const char *name,
1657                                        int vdpa_device_fd,
1658                                        int queue_pair_index,
1659                                        int nvqs,
1660                                        bool is_datapath,
1661                                        bool svq,
1662                                        struct vhost_vdpa_iova_range iova_range,
1663                                        uint64_t features,
1664                                        VhostVDPAShared *shared,
1665                                        Error **errp)
1666 {
1667     NetClientState *nc = NULL;
1668     VhostVDPAState *s;
1669     int ret = 0;
1670     assert(name);
1671     int cvq_isolated = 0;
1672 
1673     if (is_datapath) {
1674         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
1675                                  name);
1676     } else {
1677         cvq_isolated = vhost_vdpa_probe_cvq_isolation(vdpa_device_fd, features,
1678                                                       queue_pair_index * 2,
1679                                                       errp);
1680         if (unlikely(cvq_isolated < 0)) {
1681             return NULL;
1682         }
1683 
1684         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
1685                                          device, name);
1686     }
1687     qemu_set_info_str(nc, TYPE_VHOST_VDPA);
1688     s = DO_UPCAST(VhostVDPAState, nc, nc);
1689 
1690     s->vhost_vdpa.index = queue_pair_index;
1691     s->always_svq = svq;
1692     s->migration_state.notify = NULL;
1693     s->vhost_vdpa.shadow_vqs_enabled = svq;
1694     if (queue_pair_index == 0) {
1695         vhost_vdpa_net_valid_svq_features(features,
1696                                           &s->vhost_vdpa.migration_blocker);
1697         s->vhost_vdpa.shared = g_new0(VhostVDPAShared, 1);
1698         s->vhost_vdpa.shared->device_fd = vdpa_device_fd;
1699         s->vhost_vdpa.shared->iova_range = iova_range;
1700         s->vhost_vdpa.shared->shadow_data = svq;
1701         s->vhost_vdpa.shared->iova_tree = vhost_iova_tree_new(iova_range.first,
1702                                                               iova_range.last);
1703     } else if (!is_datapath) {
1704         s->cvq_cmd_out_buffer = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1705                                      PROT_READ | PROT_WRITE,
1706                                      MAP_SHARED | MAP_ANONYMOUS, -1, 0);
1707         s->status = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1708                          PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS,
1709                          -1, 0);
1710 
1711         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
1712         s->vhost_vdpa.shadow_vq_ops_opaque = s;
1713         s->cvq_isolated = cvq_isolated;
1714     }
1715     if (queue_pair_index != 0) {
1716         s->vhost_vdpa.shared = shared;
1717     }
1718 
1719     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
1720     if (ret) {
1721         qemu_del_net_client(nc);
1722         return NULL;
1723     }
1724 
1725     return nc;
1726 }
1727 
1728 static int vhost_vdpa_get_features(int fd, uint64_t *features, Error **errp)
1729 {
1730     int ret = ioctl(fd, VHOST_GET_FEATURES, features);
1731     if (unlikely(ret < 0)) {
1732         error_setg_errno(errp, errno,
1733                          "Fail to query features from vhost-vDPA device");
1734     }
1735     return ret;
1736 }
1737 
1738 static int vhost_vdpa_get_max_queue_pairs(int fd, uint64_t features,
1739                                           int *has_cvq, Error **errp)
1740 {
1741     unsigned long config_size = offsetof(struct vhost_vdpa_config, buf);
1742     g_autofree struct vhost_vdpa_config *config = NULL;
1743     __virtio16 *max_queue_pairs;
1744     int ret;
1745 
1746     if (features & (1 << VIRTIO_NET_F_CTRL_VQ)) {
1747         *has_cvq = 1;
1748     } else {
1749         *has_cvq = 0;
1750     }
1751 
1752     if (features & (1 << VIRTIO_NET_F_MQ)) {
1753         config = g_malloc0(config_size + sizeof(*max_queue_pairs));
1754         config->off = offsetof(struct virtio_net_config, max_virtqueue_pairs);
1755         config->len = sizeof(*max_queue_pairs);
1756 
1757         ret = ioctl(fd, VHOST_VDPA_GET_CONFIG, config);
1758         if (ret) {
1759             error_setg(errp, "Fail to get config from vhost-vDPA device");
1760             return -ret;
1761         }
1762 
1763         max_queue_pairs = (__virtio16 *)&config->buf;
1764 
1765         return lduw_le_p(max_queue_pairs);
1766     }
1767 
1768     return 1;
1769 }
1770 
1771 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
1772                         NetClientState *peer, Error **errp)
1773 {
1774     ERRP_GUARD();
1775     const NetdevVhostVDPAOptions *opts;
1776     uint64_t features;
1777     int vdpa_device_fd;
1778     g_autofree NetClientState **ncs = NULL;
1779     struct vhost_vdpa_iova_range iova_range;
1780     NetClientState *nc;
1781     int queue_pairs, r, i = 0, has_cvq = 0;
1782 
1783     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1784     opts = &netdev->u.vhost_vdpa;
1785     if (!opts->vhostdev && !opts->vhostfd) {
1786         error_setg(errp,
1787                    "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
1788         return -1;
1789     }
1790 
1791     if (opts->vhostdev && opts->vhostfd) {
1792         error_setg(errp,
1793                    "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
1794         return -1;
1795     }
1796 
1797     if (opts->vhostdev) {
1798         vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
1799         if (vdpa_device_fd == -1) {
1800             return -errno;
1801         }
1802     } else {
1803         /* has_vhostfd */
1804         vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
1805         if (vdpa_device_fd == -1) {
1806             error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
1807             return -1;
1808         }
1809     }
1810 
1811     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
1812     if (unlikely(r < 0)) {
1813         goto err;
1814     }
1815 
1816     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
1817                                                  &has_cvq, errp);
1818     if (queue_pairs < 0) {
1819         qemu_close(vdpa_device_fd);
1820         return queue_pairs;
1821     }
1822 
1823     r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
1824     if (unlikely(r < 0)) {
1825         error_setg(errp, "vhost-vdpa: get iova range failed: %s",
1826                    strerror(-r));
1827         goto err;
1828     }
1829 
1830     if (opts->x_svq && !vhost_vdpa_net_valid_svq_features(features, errp)) {
1831         goto err;
1832     }
1833 
1834     ncs = g_malloc0(sizeof(*ncs) * queue_pairs);
1835 
1836     for (i = 0; i < queue_pairs; i++) {
1837         VhostVDPAShared *shared = NULL;
1838 
1839         if (i) {
1840             shared = DO_UPCAST(VhostVDPAState, nc, ncs[0])->vhost_vdpa.shared;
1841         }
1842         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1843                                      vdpa_device_fd, i, 2, true, opts->x_svq,
1844                                      iova_range, features, shared, errp);
1845         if (!ncs[i])
1846             goto err;
1847     }
1848 
1849     if (has_cvq) {
1850         VhostVDPAState *s0 = DO_UPCAST(VhostVDPAState, nc, ncs[0]);
1851         VhostVDPAShared *shared = s0->vhost_vdpa.shared;
1852 
1853         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1854                                  vdpa_device_fd, i, 1, false,
1855                                  opts->x_svq, iova_range, features, shared,
1856                                  errp);
1857         if (!nc)
1858             goto err;
1859     }
1860 
1861     return 0;
1862 
1863 err:
1864     if (i) {
1865         for (i--; i >= 0; i--) {
1866             qemu_del_net_client(ncs[i]);
1867         }
1868     }
1869 
1870     qemu_close(vdpa_device_fd);
1871 
1872     return -1;
1873 }
1874