xref: /openbmc/qemu/net/vhost-vdpa.c (revision 9d5a807c)
1 /*
2  * vhost-vdpa.c
3  *
4  * Copyright(c) 2017-2018 Intel Corporation.
5  * Copyright(c) 2020 Red Hat, Inc.
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or later.
8  * See the COPYING file in the top-level directory.
9  *
10  */
11 
12 #include "qemu/osdep.h"
13 #include "clients.h"
14 #include "hw/virtio/virtio-net.h"
15 #include "net/vhost_net.h"
16 #include "net/vhost-vdpa.h"
17 #include "hw/virtio/vhost-vdpa.h"
18 #include "qemu/config-file.h"
19 #include "qemu/error-report.h"
20 #include "qemu/log.h"
21 #include "qemu/memalign.h"
22 #include "qemu/option.h"
23 #include "qapi/error.h"
24 #include <linux/vhost.h>
25 #include <sys/ioctl.h>
26 #include <err.h>
27 #include "standard-headers/linux/virtio_net.h"
28 #include "monitor/monitor.h"
29 #include "migration/misc.h"
30 #include "hw/virtio/vhost.h"
31 #include "trace.h"
32 
33 /* Todo:need to add the multiqueue support here */
34 typedef struct VhostVDPAState {
35     NetClientState nc;
36     struct vhost_vdpa vhost_vdpa;
37     NotifierWithReturn migration_state;
38     VHostNetState *vhost_net;
39 
40     /* Control commands shadow buffers */
41     void *cvq_cmd_out_buffer;
42     virtio_net_ctrl_ack *status;
43 
44     /* The device always have SVQ enabled */
45     bool always_svq;
46 
47     /* The device can isolate CVQ in its own ASID */
48     bool cvq_isolated;
49 
50     bool started;
51 } VhostVDPAState;
52 
53 /*
54  * The array is sorted alphabetically in ascending order,
55  * with the exception of VHOST_INVALID_FEATURE_BIT,
56  * which should always be the last entry.
57  */
58 const int vdpa_feature_bits[] = {
59     VIRTIO_F_ANY_LAYOUT,
60     VIRTIO_F_IOMMU_PLATFORM,
61     VIRTIO_F_NOTIFY_ON_EMPTY,
62     VIRTIO_F_RING_PACKED,
63     VIRTIO_F_RING_RESET,
64     VIRTIO_F_VERSION_1,
65     VIRTIO_NET_F_CSUM,
66     VIRTIO_NET_F_CTRL_GUEST_OFFLOADS,
67     VIRTIO_NET_F_CTRL_MAC_ADDR,
68     VIRTIO_NET_F_CTRL_RX,
69     VIRTIO_NET_F_CTRL_RX_EXTRA,
70     VIRTIO_NET_F_CTRL_VLAN,
71     VIRTIO_NET_F_CTRL_VQ,
72     VIRTIO_NET_F_GSO,
73     VIRTIO_NET_F_GUEST_CSUM,
74     VIRTIO_NET_F_GUEST_ECN,
75     VIRTIO_NET_F_GUEST_TSO4,
76     VIRTIO_NET_F_GUEST_TSO6,
77     VIRTIO_NET_F_GUEST_UFO,
78     VIRTIO_NET_F_GUEST_USO4,
79     VIRTIO_NET_F_GUEST_USO6,
80     VIRTIO_NET_F_HASH_REPORT,
81     VIRTIO_NET_F_HOST_ECN,
82     VIRTIO_NET_F_HOST_TSO4,
83     VIRTIO_NET_F_HOST_TSO6,
84     VIRTIO_NET_F_HOST_UFO,
85     VIRTIO_NET_F_HOST_USO,
86     VIRTIO_NET_F_MQ,
87     VIRTIO_NET_F_MRG_RXBUF,
88     VIRTIO_NET_F_MTU,
89     VIRTIO_NET_F_RSS,
90     VIRTIO_NET_F_STATUS,
91     VIRTIO_RING_F_EVENT_IDX,
92     VIRTIO_RING_F_INDIRECT_DESC,
93 
94     /* VHOST_INVALID_FEATURE_BIT should always be the last entry */
95     VHOST_INVALID_FEATURE_BIT
96 };
97 
98 /** Supported device specific feature bits with SVQ */
99 static const uint64_t vdpa_svq_device_features =
100     BIT_ULL(VIRTIO_NET_F_CSUM) |
101     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
102     BIT_ULL(VIRTIO_NET_F_CTRL_GUEST_OFFLOADS) |
103     BIT_ULL(VIRTIO_NET_F_MTU) |
104     BIT_ULL(VIRTIO_NET_F_MAC) |
105     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |
106     BIT_ULL(VIRTIO_NET_F_GUEST_TSO6) |
107     BIT_ULL(VIRTIO_NET_F_GUEST_ECN) |
108     BIT_ULL(VIRTIO_NET_F_GUEST_UFO) |
109     BIT_ULL(VIRTIO_NET_F_HOST_TSO4) |
110     BIT_ULL(VIRTIO_NET_F_HOST_TSO6) |
111     BIT_ULL(VIRTIO_NET_F_HOST_ECN) |
112     BIT_ULL(VIRTIO_NET_F_HOST_UFO) |
113     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
114     BIT_ULL(VIRTIO_NET_F_STATUS) |
115     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
116     BIT_ULL(VIRTIO_NET_F_CTRL_RX) |
117     BIT_ULL(VIRTIO_NET_F_CTRL_VLAN) |
118     BIT_ULL(VIRTIO_NET_F_CTRL_RX_EXTRA) |
119     BIT_ULL(VIRTIO_NET_F_MQ) |
120     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
121     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |
122     /* VHOST_F_LOG_ALL is exposed by SVQ */
123     BIT_ULL(VHOST_F_LOG_ALL) |
124     BIT_ULL(VIRTIO_NET_F_HASH_REPORT) |
125     BIT_ULL(VIRTIO_NET_F_RSS) |
126     BIT_ULL(VIRTIO_NET_F_RSC_EXT) |
127     BIT_ULL(VIRTIO_NET_F_STANDBY) |
128     BIT_ULL(VIRTIO_NET_F_SPEED_DUPLEX);
129 
130 #define VHOST_VDPA_NET_CVQ_ASID 1
131 
132 VHostNetState *vhost_vdpa_get_vhost_net(NetClientState *nc)
133 {
134     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
135     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
136     return s->vhost_net;
137 }
138 
139 static size_t vhost_vdpa_net_cvq_cmd_len(void)
140 {
141     /*
142      * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
143      * In buffer is always 1 byte, so it should fit here
144      */
145     return sizeof(struct virtio_net_ctrl_hdr) +
146            2 * sizeof(struct virtio_net_ctrl_mac) +
147            MAC_TABLE_ENTRIES * ETH_ALEN;
148 }
149 
150 static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
151 {
152     return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
153 }
154 
155 static bool vhost_vdpa_net_valid_svq_features(uint64_t features, Error **errp)
156 {
157     uint64_t invalid_dev_features =
158         features & ~vdpa_svq_device_features &
159         /* Transport are all accepted at this point */
160         ~MAKE_64BIT_MASK(VIRTIO_TRANSPORT_F_START,
161                          VIRTIO_TRANSPORT_F_END - VIRTIO_TRANSPORT_F_START);
162 
163     if (invalid_dev_features) {
164         error_setg(errp, "vdpa svq does not work with features 0x%" PRIx64,
165                    invalid_dev_features);
166         return false;
167     }
168 
169     return vhost_svq_valid_features(features, errp);
170 }
171 
172 static int vhost_vdpa_net_check_device_id(struct vhost_net *net)
173 {
174     uint32_t device_id;
175     int ret;
176     struct vhost_dev *hdev;
177 
178     hdev = (struct vhost_dev *)&net->dev;
179     ret = hdev->vhost_ops->vhost_get_device_id(hdev, &device_id);
180     if (device_id != VIRTIO_ID_NET) {
181         return -ENOTSUP;
182     }
183     return ret;
184 }
185 
186 static int vhost_vdpa_add(NetClientState *ncs, void *be,
187                           int queue_pair_index, int nvqs)
188 {
189     VhostNetOptions options;
190     struct vhost_net *net = NULL;
191     VhostVDPAState *s;
192     int ret;
193 
194     options.backend_type = VHOST_BACKEND_TYPE_VDPA;
195     assert(ncs->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
196     s = DO_UPCAST(VhostVDPAState, nc, ncs);
197     options.net_backend = ncs;
198     options.opaque      = be;
199     options.busyloop_timeout = 0;
200     options.nvqs = nvqs;
201 
202     net = vhost_net_init(&options);
203     if (!net) {
204         error_report("failed to init vhost_net for queue");
205         goto err_init;
206     }
207     s->vhost_net = net;
208     ret = vhost_vdpa_net_check_device_id(net);
209     if (ret) {
210         goto err_check;
211     }
212     return 0;
213 err_check:
214     vhost_net_cleanup(net);
215     g_free(net);
216 err_init:
217     return -1;
218 }
219 
220 static void vhost_vdpa_cleanup(NetClientState *nc)
221 {
222     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
223 
224     /*
225      * If a peer NIC is attached, do not cleanup anything.
226      * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup()
227      * when the guest is shutting down.
228      */
229     if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
230         return;
231     }
232     munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
233     munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
234     if (s->vhost_net) {
235         vhost_net_cleanup(s->vhost_net);
236         g_free(s->vhost_net);
237         s->vhost_net = NULL;
238     }
239     if (s->vhost_vdpa.index != 0) {
240         return;
241     }
242     qemu_close(s->vhost_vdpa.shared->device_fd);
243     g_free(s->vhost_vdpa.shared);
244 }
245 
246 /** Dummy SetSteeringEBPF to support RSS for vhost-vdpa backend  */
247 static bool vhost_vdpa_set_steering_ebpf(NetClientState *nc, int prog_fd)
248 {
249     return true;
250 }
251 
252 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
253 {
254     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
255 
256     return true;
257 }
258 
259 static bool vhost_vdpa_has_ufo(NetClientState *nc)
260 {
261     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
262     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
263     uint64_t features = 0;
264     features |= (1ULL << VIRTIO_NET_F_HOST_UFO);
265     features = vhost_net_get_features(s->vhost_net, features);
266     return !!(features & (1ULL << VIRTIO_NET_F_HOST_UFO));
267 
268 }
269 
270 static bool vhost_vdpa_check_peer_type(NetClientState *nc, ObjectClass *oc,
271                                        Error **errp)
272 {
273     const char *driver = object_class_get_name(oc);
274 
275     if (!g_str_has_prefix(driver, "virtio-net-")) {
276         error_setg(errp, "vhost-vdpa requires frontend driver virtio-net-*");
277         return false;
278     }
279 
280     return true;
281 }
282 
283 /** Dummy receive in case qemu falls back to userland tap networking */
284 static ssize_t vhost_vdpa_receive(NetClientState *nc, const uint8_t *buf,
285                                   size_t size)
286 {
287     return size;
288 }
289 
290 
291 /** From any vdpa net client, get the netclient of the i-th queue pair */
292 static VhostVDPAState *vhost_vdpa_net_get_nc_vdpa(VhostVDPAState *s, int i)
293 {
294     NICState *nic = qemu_get_nic(s->nc.peer);
295     NetClientState *nc_i = qemu_get_peer(nic->ncs, i);
296 
297     return DO_UPCAST(VhostVDPAState, nc, nc_i);
298 }
299 
300 static VhostVDPAState *vhost_vdpa_net_first_nc_vdpa(VhostVDPAState *s)
301 {
302     return vhost_vdpa_net_get_nc_vdpa(s, 0);
303 }
304 
305 static void vhost_vdpa_net_log_global_enable(VhostVDPAState *s, bool enable)
306 {
307     struct vhost_vdpa *v = &s->vhost_vdpa;
308     VirtIONet *n;
309     VirtIODevice *vdev;
310     int data_queue_pairs, cvq, r;
311 
312     /* We are only called on the first data vqs and only if x-svq is not set */
313     if (s->vhost_vdpa.shadow_vqs_enabled == enable) {
314         return;
315     }
316 
317     vdev = v->dev->vdev;
318     n = VIRTIO_NET(vdev);
319     if (!n->vhost_started) {
320         return;
321     }
322 
323     data_queue_pairs = n->multiqueue ? n->max_queue_pairs : 1;
324     cvq = virtio_vdev_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) ?
325                                   n->max_ncs - n->max_queue_pairs : 0;
326     v->shared->svq_switching = enable ?
327         SVQ_TSTATE_ENABLING : SVQ_TSTATE_DISABLING;
328     /*
329      * TODO: vhost_net_stop does suspend, get_base and reset. We can be smarter
330      * in the future and resume the device if read-only operations between
331      * suspend and reset goes wrong.
332      */
333     vhost_net_stop(vdev, n->nic->ncs, data_queue_pairs, cvq);
334 
335     /* Start will check migration setup_or_active to configure or not SVQ */
336     r = vhost_net_start(vdev, n->nic->ncs, data_queue_pairs, cvq);
337     if (unlikely(r < 0)) {
338         error_report("unable to start vhost net: %s(%d)", g_strerror(-r), -r);
339     }
340     v->shared->svq_switching = SVQ_TSTATE_DONE;
341 }
342 
343 static int vdpa_net_migration_state_notifier(NotifierWithReturn *notifier,
344                                              MigrationEvent *e, Error **errp)
345 {
346     VhostVDPAState *s = container_of(notifier, VhostVDPAState, migration_state);
347 
348     if (e->type == MIG_EVENT_PRECOPY_SETUP) {
349         vhost_vdpa_net_log_global_enable(s, true);
350     } else if (e->type == MIG_EVENT_PRECOPY_FAILED) {
351         vhost_vdpa_net_log_global_enable(s, false);
352     }
353     return 0;
354 }
355 
356 static void vhost_vdpa_net_data_start_first(VhostVDPAState *s)
357 {
358     struct vhost_vdpa *v = &s->vhost_vdpa;
359 
360     migration_add_notifier(&s->migration_state,
361                            vdpa_net_migration_state_notifier);
362     if (v->shadow_vqs_enabled) {
363         v->shared->iova_tree = vhost_iova_tree_new(v->shared->iova_range.first,
364                                                    v->shared->iova_range.last);
365     }
366 }
367 
368 static int vhost_vdpa_net_data_start(NetClientState *nc)
369 {
370     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
371     struct vhost_vdpa *v = &s->vhost_vdpa;
372 
373     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
374 
375     if (s->always_svq ||
376         migration_is_setup_or_active()) {
377         v->shadow_vqs_enabled = true;
378     } else {
379         v->shadow_vqs_enabled = false;
380     }
381 
382     if (v->index == 0) {
383         v->shared->shadow_data = v->shadow_vqs_enabled;
384         vhost_vdpa_net_data_start_first(s);
385         return 0;
386     }
387 
388     return 0;
389 }
390 
391 static int vhost_vdpa_net_data_load(NetClientState *nc)
392 {
393     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
394     struct vhost_vdpa *v = &s->vhost_vdpa;
395     bool has_cvq = v->dev->vq_index_end % 2;
396 
397     if (has_cvq) {
398         return 0;
399     }
400 
401     for (int i = 0; i < v->dev->nvqs; ++i) {
402         int ret = vhost_vdpa_set_vring_ready(v, i + v->dev->vq_index);
403         if (ret < 0) {
404             return ret;
405         }
406     }
407     return 0;
408 }
409 
410 static void vhost_vdpa_net_client_stop(NetClientState *nc)
411 {
412     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
413     struct vhost_dev *dev;
414 
415     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
416 
417     if (s->vhost_vdpa.index == 0) {
418         migration_remove_notifier(&s->migration_state);
419     }
420 
421     dev = s->vhost_vdpa.dev;
422     if (dev->vq_index + dev->nvqs == dev->vq_index_end) {
423         g_clear_pointer(&s->vhost_vdpa.shared->iova_tree,
424                         vhost_iova_tree_delete);
425     }
426 }
427 
428 static NetClientInfo net_vhost_vdpa_info = {
429         .type = NET_CLIENT_DRIVER_VHOST_VDPA,
430         .size = sizeof(VhostVDPAState),
431         .receive = vhost_vdpa_receive,
432         .start = vhost_vdpa_net_data_start,
433         .load = vhost_vdpa_net_data_load,
434         .stop = vhost_vdpa_net_client_stop,
435         .cleanup = vhost_vdpa_cleanup,
436         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
437         .has_ufo = vhost_vdpa_has_ufo,
438         .check_peer_type = vhost_vdpa_check_peer_type,
439         .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
440 };
441 
442 static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
443                                           Error **errp)
444 {
445     struct vhost_vring_state state = {
446         .index = vq_index,
447     };
448     int r = ioctl(device_fd, VHOST_VDPA_GET_VRING_GROUP, &state);
449 
450     if (unlikely(r < 0)) {
451         r = -errno;
452         error_setg_errno(errp, errno, "Cannot get VQ %u group", vq_index);
453         return r;
454     }
455 
456     return state.num;
457 }
458 
459 static int vhost_vdpa_set_address_space_id(struct vhost_vdpa *v,
460                                            unsigned vq_group,
461                                            unsigned asid_num)
462 {
463     struct vhost_vring_state asid = {
464         .index = vq_group,
465         .num = asid_num,
466     };
467     int r;
468 
469     trace_vhost_vdpa_set_address_space_id(v, vq_group, asid_num);
470 
471     r = ioctl(v->shared->device_fd, VHOST_VDPA_SET_GROUP_ASID, &asid);
472     if (unlikely(r < 0)) {
473         error_report("Can't set vq group %u asid %u, errno=%d (%s)",
474                      asid.index, asid.num, errno, g_strerror(errno));
475     }
476     return r;
477 }
478 
479 static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
480 {
481     VhostIOVATree *tree = v->shared->iova_tree;
482     DMAMap needle = {
483         /*
484          * No need to specify size or to look for more translations since
485          * this contiguous chunk was allocated by us.
486          */
487         .translated_addr = (hwaddr)(uintptr_t)addr,
488     };
489     const DMAMap *map = vhost_iova_tree_find_iova(tree, &needle);
490     int r;
491 
492     if (unlikely(!map)) {
493         error_report("Cannot locate expected map");
494         return;
495     }
496 
497     r = vhost_vdpa_dma_unmap(v->shared, v->address_space_id, map->iova,
498                              map->size + 1);
499     if (unlikely(r != 0)) {
500         error_report("Device cannot unmap: %s(%d)", g_strerror(r), r);
501     }
502 
503     vhost_iova_tree_remove(tree, *map);
504 }
505 
506 /** Map CVQ buffer. */
507 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
508                                   bool write)
509 {
510     DMAMap map = {};
511     int r;
512 
513     map.translated_addr = (hwaddr)(uintptr_t)buf;
514     map.size = size - 1;
515     map.perm = write ? IOMMU_RW : IOMMU_RO,
516     r = vhost_iova_tree_map_alloc(v->shared->iova_tree, &map);
517     if (unlikely(r != IOVA_OK)) {
518         error_report("Cannot map injected element");
519         return r;
520     }
521 
522     r = vhost_vdpa_dma_map(v->shared, v->address_space_id, map.iova,
523                            vhost_vdpa_net_cvq_cmd_page_len(), buf, !write);
524     if (unlikely(r < 0)) {
525         goto dma_map_err;
526     }
527 
528     return 0;
529 
530 dma_map_err:
531     vhost_iova_tree_remove(v->shared->iova_tree, map);
532     return r;
533 }
534 
535 static int vhost_vdpa_net_cvq_start(NetClientState *nc)
536 {
537     VhostVDPAState *s, *s0;
538     struct vhost_vdpa *v;
539     int64_t cvq_group;
540     int r;
541     Error *err = NULL;
542 
543     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
544 
545     s = DO_UPCAST(VhostVDPAState, nc, nc);
546     v = &s->vhost_vdpa;
547 
548     s0 = vhost_vdpa_net_first_nc_vdpa(s);
549     v->shadow_vqs_enabled = s0->vhost_vdpa.shadow_vqs_enabled;
550     s->vhost_vdpa.address_space_id = VHOST_VDPA_GUEST_PA_ASID;
551 
552     if (v->shared->shadow_data) {
553         /* SVQ is already configured for all virtqueues */
554         goto out;
555     }
556 
557     /*
558      * If we early return in these cases SVQ will not be enabled. The migration
559      * will be blocked as long as vhost-vdpa backends will not offer _F_LOG.
560      */
561     if (!vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
562         return 0;
563     }
564 
565     if (!s->cvq_isolated) {
566         return 0;
567     }
568 
569     cvq_group = vhost_vdpa_get_vring_group(v->shared->device_fd,
570                                            v->dev->vq_index_end - 1,
571                                            &err);
572     if (unlikely(cvq_group < 0)) {
573         error_report_err(err);
574         return cvq_group;
575     }
576 
577     r = vhost_vdpa_set_address_space_id(v, cvq_group, VHOST_VDPA_NET_CVQ_ASID);
578     if (unlikely(r < 0)) {
579         return r;
580     }
581 
582     v->shadow_vqs_enabled = true;
583     s->vhost_vdpa.address_space_id = VHOST_VDPA_NET_CVQ_ASID;
584 
585 out:
586     if (!s->vhost_vdpa.shadow_vqs_enabled) {
587         return 0;
588     }
589 
590     /*
591      * If other vhost_vdpa already have an iova_tree, reuse it for simplicity,
592      * whether CVQ shares ASID with guest or not, because:
593      * - Memory listener need access to guest's memory addresses allocated in
594      *   the IOVA tree.
595      * - There should be plenty of IOVA address space for both ASID not to
596      *   worry about collisions between them.  Guest's translations are still
597      *   validated with virtio virtqueue_pop so there is no risk for the guest
598      *   to access memory that it shouldn't.
599      *
600      * To allocate a iova tree per ASID is doable but it complicates the code
601      * and it is not worth it for the moment.
602      */
603     if (!v->shared->iova_tree) {
604         v->shared->iova_tree = vhost_iova_tree_new(v->shared->iova_range.first,
605                                                    v->shared->iova_range.last);
606     }
607 
608     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
609                                vhost_vdpa_net_cvq_cmd_page_len(), false);
610     if (unlikely(r < 0)) {
611         return r;
612     }
613 
614     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->status,
615                                vhost_vdpa_net_cvq_cmd_page_len(), true);
616     if (unlikely(r < 0)) {
617         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
618     }
619 
620     return r;
621 }
622 
623 static void vhost_vdpa_net_cvq_stop(NetClientState *nc)
624 {
625     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
626 
627     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
628 
629     if (s->vhost_vdpa.shadow_vqs_enabled) {
630         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
631         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->status);
632     }
633 
634     vhost_vdpa_net_client_stop(nc);
635 }
636 
637 static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s,
638                                     const struct iovec *out_sg, size_t out_num,
639                                     const struct iovec *in_sg, size_t in_num)
640 {
641     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
642     int r;
643 
644     r = vhost_svq_add(svq, out_sg, out_num, in_sg, in_num, NULL);
645     if (unlikely(r != 0)) {
646         if (unlikely(r == -ENOSPC)) {
647             qemu_log_mask(LOG_GUEST_ERROR, "%s: No space on device queue\n",
648                           __func__);
649         }
650     }
651 
652     return r;
653 }
654 
655 /*
656  * Convenience wrapper to poll SVQ for multiple control commands.
657  *
658  * Caller should hold the BQL when invoking this function, and should take
659  * the answer before SVQ pulls by itself when BQL is released.
660  */
661 static ssize_t vhost_vdpa_net_svq_poll(VhostVDPAState *s, size_t cmds_in_flight)
662 {
663     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
664     return vhost_svq_poll(svq, cmds_in_flight);
665 }
666 
667 static void vhost_vdpa_net_load_cursor_reset(VhostVDPAState *s,
668                                              struct iovec *out_cursor,
669                                              struct iovec *in_cursor)
670 {
671     /* reset the cursor of the output buffer for the device */
672     out_cursor->iov_base = s->cvq_cmd_out_buffer;
673     out_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
674 
675     /* reset the cursor of the in buffer for the device */
676     in_cursor->iov_base = s->status;
677     in_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
678 }
679 
680 /*
681  * Poll SVQ for multiple pending control commands and check the device's ack.
682  *
683  * Caller should hold the BQL when invoking this function.
684  *
685  * @s: The VhostVDPAState
686  * @len: The length of the pending status shadow buffer
687  */
688 static ssize_t vhost_vdpa_net_svq_flush(VhostVDPAState *s, size_t len)
689 {
690     /* device uses a one-byte length ack for each control command */
691     ssize_t dev_written = vhost_vdpa_net_svq_poll(s, len);
692     if (unlikely(dev_written != len)) {
693         return -EIO;
694     }
695 
696     /* check the device's ack */
697     for (int i = 0; i < len; ++i) {
698         if (s->status[i] != VIRTIO_NET_OK) {
699             return -EIO;
700         }
701     }
702     return 0;
703 }
704 
705 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s,
706                                        struct iovec *out_cursor,
707                                        struct iovec *in_cursor, uint8_t class,
708                                        uint8_t cmd, const struct iovec *data_sg,
709                                        size_t data_num)
710 {
711     const struct virtio_net_ctrl_hdr ctrl = {
712         .class = class,
713         .cmd = cmd,
714     };
715     size_t data_size = iov_size(data_sg, data_num), cmd_size;
716     struct iovec out, in;
717     ssize_t r;
718     unsigned dummy_cursor_iov_cnt;
719     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
720 
721     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
722     cmd_size = sizeof(ctrl) + data_size;
723     trace_vhost_vdpa_net_load_cmd(s, class, cmd, data_num, data_size);
724     if (vhost_svq_available_slots(svq) < 2 ||
725         iov_size(out_cursor, 1) < cmd_size) {
726         /*
727          * It is time to flush all pending control commands if SVQ is full
728          * or control commands shadow buffers are full.
729          *
730          * We can poll here since we've had BQL from the time
731          * we sent the descriptor.
732          */
733         r = vhost_vdpa_net_svq_flush(s, in_cursor->iov_base -
734                                      (void *)s->status);
735         if (unlikely(r < 0)) {
736             return r;
737         }
738 
739         vhost_vdpa_net_load_cursor_reset(s, out_cursor, in_cursor);
740     }
741 
742     /* pack the CVQ command header */
743     iov_from_buf(out_cursor, 1, 0, &ctrl, sizeof(ctrl));
744     /* pack the CVQ command command-specific-data */
745     iov_to_buf(data_sg, data_num, 0,
746                out_cursor->iov_base + sizeof(ctrl), data_size);
747 
748     /* extract the required buffer from the cursor for output */
749     iov_copy(&out, 1, out_cursor, 1, 0, cmd_size);
750     /* extract the required buffer from the cursor for input */
751     iov_copy(&in, 1, in_cursor, 1, 0, sizeof(*s->status));
752 
753     r = vhost_vdpa_net_cvq_add(s, &out, 1, &in, 1);
754     if (unlikely(r < 0)) {
755         trace_vhost_vdpa_net_load_cmd_retval(s, class, cmd, r);
756         return r;
757     }
758 
759     /* iterate the cursors */
760     dummy_cursor_iov_cnt = 1;
761     iov_discard_front(&out_cursor, &dummy_cursor_iov_cnt, cmd_size);
762     dummy_cursor_iov_cnt = 1;
763     iov_discard_front(&in_cursor, &dummy_cursor_iov_cnt, sizeof(*s->status));
764 
765     return 0;
766 }
767 
768 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n,
769                                    struct iovec *out_cursor,
770                                    struct iovec *in_cursor)
771 {
772     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
773         const struct iovec data = {
774             .iov_base = (void *)n->mac,
775             .iov_len = sizeof(n->mac),
776         };
777         ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
778                                             VIRTIO_NET_CTRL_MAC,
779                                             VIRTIO_NET_CTRL_MAC_ADDR_SET,
780                                             &data, 1);
781         if (unlikely(r < 0)) {
782             return r;
783         }
784     }
785 
786     /*
787      * According to VirtIO standard, "The device MUST have an
788      * empty MAC filtering table on reset.".
789      *
790      * Therefore, there is no need to send this CVQ command if the
791      * driver also sets an empty MAC filter table, which aligns with
792      * the device's defaults.
793      *
794      * Note that the device's defaults can mismatch the driver's
795      * configuration only at live migration.
796      */
797     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX) ||
798         n->mac_table.in_use == 0) {
799         return 0;
800     }
801 
802     uint32_t uni_entries = n->mac_table.first_multi,
803              uni_macs_size = uni_entries * ETH_ALEN,
804              mul_entries = n->mac_table.in_use - uni_entries,
805              mul_macs_size = mul_entries * ETH_ALEN;
806     struct virtio_net_ctrl_mac uni = {
807         .entries = cpu_to_le32(uni_entries),
808     };
809     struct virtio_net_ctrl_mac mul = {
810         .entries = cpu_to_le32(mul_entries),
811     };
812     const struct iovec data[] = {
813         {
814             .iov_base = &uni,
815             .iov_len = sizeof(uni),
816         }, {
817             .iov_base = n->mac_table.macs,
818             .iov_len = uni_macs_size,
819         }, {
820             .iov_base = &mul,
821             .iov_len = sizeof(mul),
822         }, {
823             .iov_base = &n->mac_table.macs[uni_macs_size],
824             .iov_len = mul_macs_size,
825         },
826     };
827     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
828                                         VIRTIO_NET_CTRL_MAC,
829                                         VIRTIO_NET_CTRL_MAC_TABLE_SET,
830                                         data, ARRAY_SIZE(data));
831     if (unlikely(r < 0)) {
832         return r;
833     }
834 
835     return 0;
836 }
837 
838 static int vhost_vdpa_net_load_rss(VhostVDPAState *s, const VirtIONet *n,
839                                    struct iovec *out_cursor,
840                                    struct iovec *in_cursor, bool do_rss)
841 {
842     struct virtio_net_rss_config cfg = {};
843     ssize_t r;
844     g_autofree uint16_t *table = NULL;
845 
846     /*
847      * According to VirtIO standard, "Initially the device has all hash
848      * types disabled and reports only VIRTIO_NET_HASH_REPORT_NONE.".
849      *
850      * Therefore, there is no need to send this CVQ command if the
851      * driver disables the all hash types, which aligns with
852      * the device's defaults.
853      *
854      * Note that the device's defaults can mismatch the driver's
855      * configuration only at live migration.
856      */
857     if (!n->rss_data.enabled ||
858         n->rss_data.hash_types == VIRTIO_NET_HASH_REPORT_NONE) {
859         return 0;
860     }
861 
862     table = g_malloc_n(n->rss_data.indirections_len,
863                        sizeof(n->rss_data.indirections_table[0]));
864     cfg.hash_types = cpu_to_le32(n->rss_data.hash_types);
865 
866     if (do_rss) {
867         /*
868          * According to VirtIO standard, "Number of entries in indirection_table
869          * is (indirection_table_mask + 1)".
870          */
871         cfg.indirection_table_mask = cpu_to_le16(n->rss_data.indirections_len -
872                                                  1);
873         cfg.unclassified_queue = cpu_to_le16(n->rss_data.default_queue);
874         for (int i = 0; i < n->rss_data.indirections_len; ++i) {
875             table[i] = cpu_to_le16(n->rss_data.indirections_table[i]);
876         }
877         cfg.max_tx_vq = cpu_to_le16(n->curr_queue_pairs);
878     } else {
879         /*
880          * According to VirtIO standard, "Field reserved MUST contain zeroes.
881          * It is defined to make the structure to match the layout of
882          * virtio_net_rss_config structure, defined in 5.1.6.5.7.".
883          *
884          * Therefore, we need to zero the fields in
885          * struct virtio_net_rss_config, which corresponds to the
886          * `reserved` field in struct virtio_net_hash_config.
887          *
888          * Note that all other fields are zeroed at their definitions,
889          * except for the `indirection_table` field, where the actual data
890          * is stored in the `table` variable to ensure compatibility
891          * with RSS case. Therefore, we need to zero the `table` variable here.
892          */
893         table[0] = 0;
894     }
895 
896     /*
897      * Considering that virtio_net_handle_rss() currently does not restore
898      * the hash key length parsed from the CVQ command sent from the guest
899      * into n->rss_data and uses the maximum key length in other code, so
900      * we also employ the maximum key length here.
901      */
902     cfg.hash_key_length = sizeof(n->rss_data.key);
903 
904     const struct iovec data[] = {
905         {
906             .iov_base = &cfg,
907             .iov_len = offsetof(struct virtio_net_rss_config,
908                                 indirection_table),
909         }, {
910             .iov_base = table,
911             .iov_len = n->rss_data.indirections_len *
912                        sizeof(n->rss_data.indirections_table[0]),
913         }, {
914             .iov_base = &cfg.max_tx_vq,
915             .iov_len = offsetof(struct virtio_net_rss_config, hash_key_data) -
916                        offsetof(struct virtio_net_rss_config, max_tx_vq),
917         }, {
918             .iov_base = (void *)n->rss_data.key,
919             .iov_len = sizeof(n->rss_data.key),
920         }
921     };
922 
923     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
924                                 VIRTIO_NET_CTRL_MQ,
925                                 do_rss ? VIRTIO_NET_CTRL_MQ_RSS_CONFIG :
926                                 VIRTIO_NET_CTRL_MQ_HASH_CONFIG,
927                                 data, ARRAY_SIZE(data));
928     if (unlikely(r < 0)) {
929         return r;
930     }
931 
932     return 0;
933 }
934 
935 static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
936                                   const VirtIONet *n,
937                                   struct iovec *out_cursor,
938                                   struct iovec *in_cursor)
939 {
940     struct virtio_net_ctrl_mq mq;
941     ssize_t r;
942 
943     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_MQ)) {
944         return 0;
945     }
946 
947     trace_vhost_vdpa_net_load_mq(s, n->curr_queue_pairs);
948 
949     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
950     const struct iovec data = {
951         .iov_base = &mq,
952         .iov_len = sizeof(mq),
953     };
954     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
955                                 VIRTIO_NET_CTRL_MQ,
956                                 VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET,
957                                 &data, 1);
958     if (unlikely(r < 0)) {
959         return r;
960     }
961 
962     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_RSS)) {
963         /* load the receive-side scaling state */
964         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, true);
965         if (unlikely(r < 0)) {
966             return r;
967         }
968     } else if (virtio_vdev_has_feature(&n->parent_obj,
969                                        VIRTIO_NET_F_HASH_REPORT)) {
970         /* load the hash calculation state */
971         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, false);
972         if (unlikely(r < 0)) {
973             return r;
974         }
975     }
976 
977     return 0;
978 }
979 
980 static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
981                                         const VirtIONet *n,
982                                         struct iovec *out_cursor,
983                                         struct iovec *in_cursor)
984 {
985     uint64_t offloads;
986     ssize_t r;
987 
988     if (!virtio_vdev_has_feature(&n->parent_obj,
989                                  VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) {
990         return 0;
991     }
992 
993     if (n->curr_guest_offloads == virtio_net_supported_guest_offloads(n)) {
994         /*
995          * According to VirtIO standard, "Upon feature negotiation
996          * corresponding offload gets enabled to preserve
997          * backward compatibility.".
998          *
999          * Therefore, there is no need to send this CVQ command if the
1000          * driver also enables all supported offloads, which aligns with
1001          * the device's defaults.
1002          *
1003          * Note that the device's defaults can mismatch the driver's
1004          * configuration only at live migration.
1005          */
1006         return 0;
1007     }
1008 
1009     offloads = cpu_to_le64(n->curr_guest_offloads);
1010     const struct iovec data = {
1011         .iov_base = &offloads,
1012         .iov_len = sizeof(offloads),
1013     };
1014     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1015                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS,
1016                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET,
1017                                 &data, 1);
1018     if (unlikely(r < 0)) {
1019         return r;
1020     }
1021 
1022     return 0;
1023 }
1024 
1025 static int vhost_vdpa_net_load_rx_mode(VhostVDPAState *s,
1026                                        struct iovec *out_cursor,
1027                                        struct iovec *in_cursor,
1028                                        uint8_t cmd,
1029                                        uint8_t on)
1030 {
1031     const struct iovec data = {
1032         .iov_base = &on,
1033         .iov_len = sizeof(on),
1034     };
1035     ssize_t r;
1036 
1037     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1038                                 VIRTIO_NET_CTRL_RX, cmd, &data, 1);
1039     if (unlikely(r < 0)) {
1040         return r;
1041     }
1042 
1043     return 0;
1044 }
1045 
1046 static int vhost_vdpa_net_load_rx(VhostVDPAState *s,
1047                                   const VirtIONet *n,
1048                                   struct iovec *out_cursor,
1049                                   struct iovec *in_cursor)
1050 {
1051     ssize_t r;
1052 
1053     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX)) {
1054         return 0;
1055     }
1056 
1057     /*
1058      * According to virtio_net_reset(), device turns promiscuous mode
1059      * on by default.
1060      *
1061      * Additionally, according to VirtIO standard, "Since there are
1062      * no guarantees, it can use a hash filter or silently switch to
1063      * allmulti or promiscuous mode if it is given too many addresses.".
1064      * QEMU marks `n->mac_table.uni_overflow` if guest sets too many
1065      * non-multicast MAC addresses, indicating that promiscuous mode
1066      * should be enabled.
1067      *
1068      * Therefore, QEMU should only send this CVQ command if the
1069      * `n->mac_table.uni_overflow` is not marked and `n->promisc` is off,
1070      * which sets promiscuous mode on, different from the device's defaults.
1071      *
1072      * Note that the device's defaults can mismatch the driver's
1073      * configuration only at live migration.
1074      */
1075     if (!n->mac_table.uni_overflow && !n->promisc) {
1076         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1077                                         VIRTIO_NET_CTRL_RX_PROMISC, 0);
1078         if (unlikely(r < 0)) {
1079             return r;
1080         }
1081     }
1082 
1083     /*
1084      * According to virtio_net_reset(), device turns all-multicast mode
1085      * off by default.
1086      *
1087      * According to VirtIO standard, "Since there are no guarantees,
1088      * it can use a hash filter or silently switch to allmulti or
1089      * promiscuous mode if it is given too many addresses.". QEMU marks
1090      * `n->mac_table.multi_overflow` if guest sets too many
1091      * non-multicast MAC addresses.
1092      *
1093      * Therefore, QEMU should only send this CVQ command if the
1094      * `n->mac_table.multi_overflow` is marked or `n->allmulti` is on,
1095      * which sets all-multicast mode on, different from the device's defaults.
1096      *
1097      * Note that the device's defaults can mismatch the driver's
1098      * configuration only at live migration.
1099      */
1100     if (n->mac_table.multi_overflow || n->allmulti) {
1101         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1102                                         VIRTIO_NET_CTRL_RX_ALLMULTI, 1);
1103         if (unlikely(r < 0)) {
1104             return r;
1105         }
1106     }
1107 
1108     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX_EXTRA)) {
1109         return 0;
1110     }
1111 
1112     /*
1113      * According to virtio_net_reset(), device turns all-unicast mode
1114      * off by default.
1115      *
1116      * Therefore, QEMU should only send this CVQ command if the driver
1117      * sets all-unicast mode on, different from the device's defaults.
1118      *
1119      * Note that the device's defaults can mismatch the driver's
1120      * configuration only at live migration.
1121      */
1122     if (n->alluni) {
1123         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1124                                         VIRTIO_NET_CTRL_RX_ALLUNI, 1);
1125         if (r < 0) {
1126             return r;
1127         }
1128     }
1129 
1130     /*
1131      * According to virtio_net_reset(), device turns non-multicast mode
1132      * off by default.
1133      *
1134      * Therefore, QEMU should only send this CVQ command if the driver
1135      * sets non-multicast mode on, different from the device's defaults.
1136      *
1137      * Note that the device's defaults can mismatch the driver's
1138      * configuration only at live migration.
1139      */
1140     if (n->nomulti) {
1141         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1142                                         VIRTIO_NET_CTRL_RX_NOMULTI, 1);
1143         if (r < 0) {
1144             return r;
1145         }
1146     }
1147 
1148     /*
1149      * According to virtio_net_reset(), device turns non-unicast mode
1150      * off by default.
1151      *
1152      * Therefore, QEMU should only send this CVQ command if the driver
1153      * sets non-unicast mode on, different from the device's defaults.
1154      *
1155      * Note that the device's defaults can mismatch the driver's
1156      * configuration only at live migration.
1157      */
1158     if (n->nouni) {
1159         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1160                                         VIRTIO_NET_CTRL_RX_NOUNI, 1);
1161         if (r < 0) {
1162             return r;
1163         }
1164     }
1165 
1166     /*
1167      * According to virtio_net_reset(), device turns non-broadcast mode
1168      * off by default.
1169      *
1170      * Therefore, QEMU should only send this CVQ command if the driver
1171      * sets non-broadcast mode on, different from the device's defaults.
1172      *
1173      * Note that the device's defaults can mismatch the driver's
1174      * configuration only at live migration.
1175      */
1176     if (n->nobcast) {
1177         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1178                                         VIRTIO_NET_CTRL_RX_NOBCAST, 1);
1179         if (r < 0) {
1180             return r;
1181         }
1182     }
1183 
1184     return 0;
1185 }
1186 
1187 static int vhost_vdpa_net_load_single_vlan(VhostVDPAState *s,
1188                                            const VirtIONet *n,
1189                                            struct iovec *out_cursor,
1190                                            struct iovec *in_cursor,
1191                                            uint16_t vid)
1192 {
1193     const struct iovec data = {
1194         .iov_base = &vid,
1195         .iov_len = sizeof(vid),
1196     };
1197     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1198                                         VIRTIO_NET_CTRL_VLAN,
1199                                         VIRTIO_NET_CTRL_VLAN_ADD,
1200                                         &data, 1);
1201     if (unlikely(r < 0)) {
1202         return r;
1203     }
1204 
1205     return 0;
1206 }
1207 
1208 static int vhost_vdpa_net_load_vlan(VhostVDPAState *s,
1209                                     const VirtIONet *n,
1210                                     struct iovec *out_cursor,
1211                                     struct iovec *in_cursor)
1212 {
1213     int r;
1214 
1215     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_VLAN)) {
1216         return 0;
1217     }
1218 
1219     for (int i = 0; i < MAX_VLAN >> 5; i++) {
1220         for (int j = 0; n->vlans[i] && j <= 0x1f; j++) {
1221             if (n->vlans[i] & (1U << j)) {
1222                 r = vhost_vdpa_net_load_single_vlan(s, n, out_cursor,
1223                                                     in_cursor, (i << 5) + j);
1224                 if (unlikely(r != 0)) {
1225                     return r;
1226                 }
1227             }
1228         }
1229     }
1230 
1231     return 0;
1232 }
1233 
1234 static int vhost_vdpa_net_cvq_load(NetClientState *nc)
1235 {
1236     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
1237     struct vhost_vdpa *v = &s->vhost_vdpa;
1238     const VirtIONet *n;
1239     int r;
1240     struct iovec out_cursor, in_cursor;
1241 
1242     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1243 
1244     r = vhost_vdpa_set_vring_ready(v, v->dev->vq_index);
1245     if (unlikely(r < 0)) {
1246         return r;
1247     }
1248 
1249     if (v->shadow_vqs_enabled) {
1250         n = VIRTIO_NET(v->dev->vdev);
1251         vhost_vdpa_net_load_cursor_reset(s, &out_cursor, &in_cursor);
1252         r = vhost_vdpa_net_load_mac(s, n, &out_cursor, &in_cursor);
1253         if (unlikely(r < 0)) {
1254             return r;
1255         }
1256         r = vhost_vdpa_net_load_mq(s, n, &out_cursor, &in_cursor);
1257         if (unlikely(r)) {
1258             return r;
1259         }
1260         r = vhost_vdpa_net_load_offloads(s, n, &out_cursor, &in_cursor);
1261         if (unlikely(r)) {
1262             return r;
1263         }
1264         r = vhost_vdpa_net_load_rx(s, n, &out_cursor, &in_cursor);
1265         if (unlikely(r)) {
1266             return r;
1267         }
1268         r = vhost_vdpa_net_load_vlan(s, n, &out_cursor, &in_cursor);
1269         if (unlikely(r)) {
1270             return r;
1271         }
1272 
1273         /*
1274          * We need to poll and check all pending device's used buffers.
1275          *
1276          * We can poll here since we've had BQL from the time
1277          * we sent the descriptor.
1278          */
1279         r = vhost_vdpa_net_svq_flush(s, in_cursor.iov_base - (void *)s->status);
1280         if (unlikely(r)) {
1281             return r;
1282         }
1283     }
1284 
1285     for (int i = 0; i < v->dev->vq_index; ++i) {
1286         r = vhost_vdpa_set_vring_ready(v, i);
1287         if (unlikely(r < 0)) {
1288             return r;
1289         }
1290     }
1291 
1292     return 0;
1293 }
1294 
1295 static NetClientInfo net_vhost_vdpa_cvq_info = {
1296     .type = NET_CLIENT_DRIVER_VHOST_VDPA,
1297     .size = sizeof(VhostVDPAState),
1298     .receive = vhost_vdpa_receive,
1299     .start = vhost_vdpa_net_cvq_start,
1300     .load = vhost_vdpa_net_cvq_load,
1301     .stop = vhost_vdpa_net_cvq_stop,
1302     .cleanup = vhost_vdpa_cleanup,
1303     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
1304     .has_ufo = vhost_vdpa_has_ufo,
1305     .check_peer_type = vhost_vdpa_check_peer_type,
1306     .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
1307 };
1308 
1309 /*
1310  * Forward the excessive VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command to
1311  * vdpa device.
1312  *
1313  * Considering that QEMU cannot send the entire filter table to the
1314  * vdpa device, it should send the VIRTIO_NET_CTRL_RX_PROMISC CVQ
1315  * command to enable promiscuous mode to receive all packets,
1316  * according to VirtIO standard, "Since there are no guarantees,
1317  * it can use a hash filter or silently switch to allmulti or
1318  * promiscuous mode if it is given too many addresses.".
1319  *
1320  * Since QEMU ignores MAC addresses beyond `MAC_TABLE_ENTRIES` and
1321  * marks `n->mac_table.x_overflow` accordingly, it should have
1322  * the same effect on the device model to receive
1323  * (`MAC_TABLE_ENTRIES` + 1) or more non-multicast MAC addresses.
1324  * The same applies to multicast MAC addresses.
1325  *
1326  * Therefore, QEMU can provide the device model with a fake
1327  * VIRTIO_NET_CTRL_MAC_TABLE_SET command with (`MAC_TABLE_ENTRIES` + 1)
1328  * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1) multicast
1329  * MAC addresses. This ensures that the device model marks
1330  * `n->mac_table.uni_overflow` and `n->mac_table.multi_overflow`,
1331  * allowing all packets to be received, which aligns with the
1332  * state of the vdpa device.
1333  */
1334 static int vhost_vdpa_net_excessive_mac_filter_cvq_add(VhostVDPAState *s,
1335                                                        VirtQueueElement *elem,
1336                                                        struct iovec *out,
1337                                                        const struct iovec *in)
1338 {
1339     struct virtio_net_ctrl_mac mac_data, *mac_ptr;
1340     struct virtio_net_ctrl_hdr *hdr_ptr;
1341     uint32_t cursor;
1342     ssize_t r;
1343     uint8_t on = 1;
1344 
1345     /* parse the non-multicast MAC address entries from CVQ command */
1346     cursor = sizeof(*hdr_ptr);
1347     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1348                    &mac_data, sizeof(mac_data));
1349     if (unlikely(r != sizeof(mac_data))) {
1350         /*
1351          * If the CVQ command is invalid, we should simulate the vdpa device
1352          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1353          */
1354         *s->status = VIRTIO_NET_ERR;
1355         return sizeof(*s->status);
1356     }
1357     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1358 
1359     /* parse the multicast MAC address entries from CVQ command */
1360     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1361                    &mac_data, sizeof(mac_data));
1362     if (r != sizeof(mac_data)) {
1363         /*
1364          * If the CVQ command is invalid, we should simulate the vdpa device
1365          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1366          */
1367         *s->status = VIRTIO_NET_ERR;
1368         return sizeof(*s->status);
1369     }
1370     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1371 
1372     /* validate the CVQ command */
1373     if (iov_size(elem->out_sg, elem->out_num) != cursor) {
1374         /*
1375          * If the CVQ command is invalid, we should simulate the vdpa device
1376          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1377          */
1378         *s->status = VIRTIO_NET_ERR;
1379         return sizeof(*s->status);
1380     }
1381 
1382     /*
1383      * According to VirtIO standard, "Since there are no guarantees,
1384      * it can use a hash filter or silently switch to allmulti or
1385      * promiscuous mode if it is given too many addresses.".
1386      *
1387      * Therefore, considering that QEMU is unable to send the entire
1388      * filter table to the vdpa device, it should send the
1389      * VIRTIO_NET_CTRL_RX_PROMISC CVQ command to enable promiscuous mode
1390      */
1391     hdr_ptr = out->iov_base;
1392     out->iov_len = sizeof(*hdr_ptr) + sizeof(on);
1393 
1394     hdr_ptr->class = VIRTIO_NET_CTRL_RX;
1395     hdr_ptr->cmd = VIRTIO_NET_CTRL_RX_PROMISC;
1396     iov_from_buf(out, 1, sizeof(*hdr_ptr), &on, sizeof(on));
1397     r = vhost_vdpa_net_cvq_add(s, out, 1, in, 1);
1398     if (unlikely(r < 0)) {
1399         return r;
1400     }
1401 
1402     /*
1403      * We can poll here since we've had BQL from the time
1404      * we sent the descriptor.
1405      */
1406     r = vhost_vdpa_net_svq_poll(s, 1);
1407     if (unlikely(r < sizeof(*s->status))) {
1408         return r;
1409     }
1410     if (*s->status != VIRTIO_NET_OK) {
1411         return sizeof(*s->status);
1412     }
1413 
1414     /*
1415      * QEMU should also send a fake VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ
1416      * command to the device model, including (`MAC_TABLE_ENTRIES` + 1)
1417      * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1)
1418      * multicast MAC addresses.
1419      *
1420      * By doing so, the device model can mark `n->mac_table.uni_overflow`
1421      * and `n->mac_table.multi_overflow`, enabling all packets to be
1422      * received, which aligns with the state of the vdpa device.
1423      */
1424     cursor = 0;
1425     uint32_t fake_uni_entries = MAC_TABLE_ENTRIES + 1,
1426              fake_mul_entries = MAC_TABLE_ENTRIES + 1,
1427              fake_cvq_size = sizeof(struct virtio_net_ctrl_hdr) +
1428                              sizeof(mac_data) + fake_uni_entries * ETH_ALEN +
1429                              sizeof(mac_data) + fake_mul_entries * ETH_ALEN;
1430 
1431     assert(fake_cvq_size < vhost_vdpa_net_cvq_cmd_page_len());
1432     out->iov_len = fake_cvq_size;
1433 
1434     /* pack the header for fake CVQ command */
1435     hdr_ptr = out->iov_base + cursor;
1436     hdr_ptr->class = VIRTIO_NET_CTRL_MAC;
1437     hdr_ptr->cmd = VIRTIO_NET_CTRL_MAC_TABLE_SET;
1438     cursor += sizeof(*hdr_ptr);
1439 
1440     /*
1441      * Pack the non-multicast MAC addresses part for fake CVQ command.
1442      *
1443      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1444      * addresses provided in CVQ command. Therefore, only the entries
1445      * field need to be prepared in the CVQ command.
1446      */
1447     mac_ptr = out->iov_base + cursor;
1448     mac_ptr->entries = cpu_to_le32(fake_uni_entries);
1449     cursor += sizeof(*mac_ptr) + fake_uni_entries * ETH_ALEN;
1450 
1451     /*
1452      * Pack the multicast MAC addresses part for fake CVQ command.
1453      *
1454      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1455      * addresses provided in CVQ command. Therefore, only the entries
1456      * field need to be prepared in the CVQ command.
1457      */
1458     mac_ptr = out->iov_base + cursor;
1459     mac_ptr->entries = cpu_to_le32(fake_mul_entries);
1460 
1461     /*
1462      * Simulating QEMU poll a vdpa device used buffer
1463      * for VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1464      */
1465     return sizeof(*s->status);
1466 }
1467 
1468 /**
1469  * Validate and copy control virtqueue commands.
1470  *
1471  * Following QEMU guidelines, we offer a copy of the buffers to the device to
1472  * prevent TOCTOU bugs.
1473  */
1474 static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
1475                                             VirtQueueElement *elem,
1476                                             void *opaque)
1477 {
1478     VhostVDPAState *s = opaque;
1479     size_t in_len;
1480     const struct virtio_net_ctrl_hdr *ctrl;
1481     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
1482     /* Out buffer sent to both the vdpa device and the device model */
1483     struct iovec out = {
1484         .iov_base = s->cvq_cmd_out_buffer,
1485     };
1486     /* in buffer used for device model */
1487     const struct iovec model_in = {
1488         .iov_base = &status,
1489         .iov_len = sizeof(status),
1490     };
1491     /* in buffer used for vdpa device */
1492     const struct iovec vdpa_in = {
1493         .iov_base = s->status,
1494         .iov_len = sizeof(*s->status),
1495     };
1496     ssize_t dev_written = -EINVAL;
1497 
1498     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
1499                              s->cvq_cmd_out_buffer,
1500                              vhost_vdpa_net_cvq_cmd_page_len());
1501 
1502     ctrl = s->cvq_cmd_out_buffer;
1503     if (ctrl->class == VIRTIO_NET_CTRL_ANNOUNCE) {
1504         /*
1505          * Guest announce capability is emulated by qemu, so don't forward to
1506          * the device.
1507          */
1508         dev_written = sizeof(status);
1509         *s->status = VIRTIO_NET_OK;
1510     } else if (unlikely(ctrl->class == VIRTIO_NET_CTRL_MAC &&
1511                         ctrl->cmd == VIRTIO_NET_CTRL_MAC_TABLE_SET &&
1512                         iov_size(elem->out_sg, elem->out_num) > out.iov_len)) {
1513         /*
1514          * Due to the size limitation of the out buffer sent to the vdpa device,
1515          * which is determined by vhost_vdpa_net_cvq_cmd_page_len(), excessive
1516          * MAC addresses set by the driver for the filter table can cause
1517          * truncation of the CVQ command in QEMU. As a result, the vdpa device
1518          * rejects the flawed CVQ command.
1519          *
1520          * Therefore, QEMU must handle this situation instead of sending
1521          * the CVQ command directly.
1522          */
1523         dev_written = vhost_vdpa_net_excessive_mac_filter_cvq_add(s, elem,
1524                                                             &out, &vdpa_in);
1525         if (unlikely(dev_written < 0)) {
1526             goto out;
1527         }
1528     } else {
1529         ssize_t r;
1530         r = vhost_vdpa_net_cvq_add(s, &out, 1, &vdpa_in, 1);
1531         if (unlikely(r < 0)) {
1532             dev_written = r;
1533             goto out;
1534         }
1535 
1536         /*
1537          * We can poll here since we've had BQL from the time
1538          * we sent the descriptor.
1539          */
1540         dev_written = vhost_vdpa_net_svq_poll(s, 1);
1541     }
1542 
1543     if (unlikely(dev_written < sizeof(status))) {
1544         error_report("Insufficient written data (%zu)", dev_written);
1545         goto out;
1546     }
1547 
1548     if (*s->status != VIRTIO_NET_OK) {
1549         goto out;
1550     }
1551 
1552     status = VIRTIO_NET_ERR;
1553     virtio_net_handle_ctrl_iov(svq->vdev, &model_in, 1, &out, 1);
1554     if (status != VIRTIO_NET_OK) {
1555         error_report("Bad CVQ processing in model");
1556     }
1557 
1558 out:
1559     in_len = iov_from_buf(elem->in_sg, elem->in_num, 0, &status,
1560                           sizeof(status));
1561     if (unlikely(in_len < sizeof(status))) {
1562         error_report("Bad device CVQ written length");
1563     }
1564     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
1565     /*
1566      * `elem` belongs to vhost_vdpa_net_handle_ctrl_avail() only when
1567      * the function successfully forwards the CVQ command, indicated
1568      * by a non-negative value of `dev_written`. Otherwise, it still
1569      * belongs to SVQ.
1570      * This function should only free the `elem` when it owns.
1571      */
1572     if (dev_written >= 0) {
1573         g_free(elem);
1574     }
1575     return dev_written < 0 ? dev_written : 0;
1576 }
1577 
1578 static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
1579     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
1580 };
1581 
1582 /**
1583  * Probe if CVQ is isolated
1584  *
1585  * @device_fd         The vdpa device fd
1586  * @features          Features offered by the device.
1587  * @cvq_index         The control vq pair index
1588  *
1589  * Returns <0 in case of failure, 0 if false and 1 if true.
1590  */
1591 static int vhost_vdpa_probe_cvq_isolation(int device_fd, uint64_t features,
1592                                           int cvq_index, Error **errp)
1593 {
1594     ERRP_GUARD();
1595     uint64_t backend_features;
1596     int64_t cvq_group;
1597     uint8_t status = VIRTIO_CONFIG_S_ACKNOWLEDGE |
1598                      VIRTIO_CONFIG_S_DRIVER;
1599     int r;
1600 
1601     r = ioctl(device_fd, VHOST_GET_BACKEND_FEATURES, &backend_features);
1602     if (unlikely(r < 0)) {
1603         error_setg_errno(errp, errno, "Cannot get vdpa backend_features");
1604         return r;
1605     }
1606 
1607     if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID))) {
1608         return 0;
1609     }
1610 
1611     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1612     if (unlikely(r)) {
1613         error_setg_errno(errp, -r, "Cannot set device status");
1614         goto out;
1615     }
1616 
1617     r = ioctl(device_fd, VHOST_SET_FEATURES, &features);
1618     if (unlikely(r)) {
1619         error_setg_errno(errp, -r, "Cannot set features");
1620         goto out;
1621     }
1622 
1623     status |= VIRTIO_CONFIG_S_FEATURES_OK;
1624     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1625     if (unlikely(r)) {
1626         error_setg_errno(errp, -r, "Cannot set device status");
1627         goto out;
1628     }
1629 
1630     cvq_group = vhost_vdpa_get_vring_group(device_fd, cvq_index, errp);
1631     if (unlikely(cvq_group < 0)) {
1632         if (cvq_group != -ENOTSUP) {
1633             r = cvq_group;
1634             goto out;
1635         }
1636 
1637         /*
1638          * The kernel report VHOST_BACKEND_F_IOTLB_ASID if the vdpa frontend
1639          * support ASID even if the parent driver does not.  The CVQ cannot be
1640          * isolated in this case.
1641          */
1642         error_free(*errp);
1643         *errp = NULL;
1644         r = 0;
1645         goto out;
1646     }
1647 
1648     for (int i = 0; i < cvq_index; ++i) {
1649         int64_t group = vhost_vdpa_get_vring_group(device_fd, i, errp);
1650         if (unlikely(group < 0)) {
1651             r = group;
1652             goto out;
1653         }
1654 
1655         if (group == (int64_t)cvq_group) {
1656             r = 0;
1657             goto out;
1658         }
1659     }
1660 
1661     r = 1;
1662 
1663 out:
1664     status = 0;
1665     ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1666     return r;
1667 }
1668 
1669 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
1670                                        const char *device,
1671                                        const char *name,
1672                                        int vdpa_device_fd,
1673                                        int queue_pair_index,
1674                                        int nvqs,
1675                                        bool is_datapath,
1676                                        bool svq,
1677                                        struct vhost_vdpa_iova_range iova_range,
1678                                        uint64_t features,
1679                                        VhostVDPAShared *shared,
1680                                        Error **errp)
1681 {
1682     NetClientState *nc = NULL;
1683     VhostVDPAState *s;
1684     int ret = 0;
1685     assert(name);
1686     int cvq_isolated = 0;
1687 
1688     if (is_datapath) {
1689         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
1690                                  name);
1691     } else {
1692         cvq_isolated = vhost_vdpa_probe_cvq_isolation(vdpa_device_fd, features,
1693                                                       queue_pair_index * 2,
1694                                                       errp);
1695         if (unlikely(cvq_isolated < 0)) {
1696             return NULL;
1697         }
1698 
1699         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
1700                                          device, name);
1701     }
1702     qemu_set_info_str(nc, TYPE_VHOST_VDPA);
1703     s = DO_UPCAST(VhostVDPAState, nc, nc);
1704 
1705     s->vhost_vdpa.index = queue_pair_index;
1706     s->always_svq = svq;
1707     s->migration_state.notify = NULL;
1708     s->vhost_vdpa.shadow_vqs_enabled = svq;
1709     if (queue_pair_index == 0) {
1710         vhost_vdpa_net_valid_svq_features(features,
1711                                           &s->vhost_vdpa.migration_blocker);
1712         s->vhost_vdpa.shared = g_new0(VhostVDPAShared, 1);
1713         s->vhost_vdpa.shared->device_fd = vdpa_device_fd;
1714         s->vhost_vdpa.shared->iova_range = iova_range;
1715         s->vhost_vdpa.shared->shadow_data = svq;
1716     } else if (!is_datapath) {
1717         s->cvq_cmd_out_buffer = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1718                                      PROT_READ | PROT_WRITE,
1719                                      MAP_SHARED | MAP_ANONYMOUS, -1, 0);
1720         s->status = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1721                          PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS,
1722                          -1, 0);
1723 
1724         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
1725         s->vhost_vdpa.shadow_vq_ops_opaque = s;
1726         s->cvq_isolated = cvq_isolated;
1727     }
1728     if (queue_pair_index != 0) {
1729         s->vhost_vdpa.shared = shared;
1730     }
1731 
1732     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
1733     if (ret) {
1734         qemu_del_net_client(nc);
1735         return NULL;
1736     }
1737 
1738     return nc;
1739 }
1740 
1741 static int vhost_vdpa_get_features(int fd, uint64_t *features, Error **errp)
1742 {
1743     int ret = ioctl(fd, VHOST_GET_FEATURES, features);
1744     if (unlikely(ret < 0)) {
1745         error_setg_errno(errp, errno,
1746                          "Fail to query features from vhost-vDPA device");
1747     }
1748     return ret;
1749 }
1750 
1751 static int vhost_vdpa_get_max_queue_pairs(int fd, uint64_t features,
1752                                           int *has_cvq, Error **errp)
1753 {
1754     unsigned long config_size = offsetof(struct vhost_vdpa_config, buf);
1755     g_autofree struct vhost_vdpa_config *config = NULL;
1756     __virtio16 *max_queue_pairs;
1757     int ret;
1758 
1759     if (features & (1 << VIRTIO_NET_F_CTRL_VQ)) {
1760         *has_cvq = 1;
1761     } else {
1762         *has_cvq = 0;
1763     }
1764 
1765     if (features & (1 << VIRTIO_NET_F_MQ)) {
1766         config = g_malloc0(config_size + sizeof(*max_queue_pairs));
1767         config->off = offsetof(struct virtio_net_config, max_virtqueue_pairs);
1768         config->len = sizeof(*max_queue_pairs);
1769 
1770         ret = ioctl(fd, VHOST_VDPA_GET_CONFIG, config);
1771         if (ret) {
1772             error_setg(errp, "Fail to get config from vhost-vDPA device");
1773             return -ret;
1774         }
1775 
1776         max_queue_pairs = (__virtio16 *)&config->buf;
1777 
1778         return lduw_le_p(max_queue_pairs);
1779     }
1780 
1781     return 1;
1782 }
1783 
1784 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
1785                         NetClientState *peer, Error **errp)
1786 {
1787     ERRP_GUARD();
1788     const NetdevVhostVDPAOptions *opts;
1789     uint64_t features;
1790     int vdpa_device_fd;
1791     g_autofree NetClientState **ncs = NULL;
1792     struct vhost_vdpa_iova_range iova_range;
1793     NetClientState *nc;
1794     int queue_pairs, r, i = 0, has_cvq = 0;
1795 
1796     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1797     opts = &netdev->u.vhost_vdpa;
1798     if (!opts->vhostdev && !opts->vhostfd) {
1799         error_setg(errp,
1800                    "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
1801         return -1;
1802     }
1803 
1804     if (opts->vhostdev && opts->vhostfd) {
1805         error_setg(errp,
1806                    "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
1807         return -1;
1808     }
1809 
1810     if (opts->vhostdev) {
1811         vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
1812         if (vdpa_device_fd == -1) {
1813             return -errno;
1814         }
1815     } else {
1816         /* has_vhostfd */
1817         vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
1818         if (vdpa_device_fd == -1) {
1819             error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
1820             return -1;
1821         }
1822     }
1823 
1824     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
1825     if (unlikely(r < 0)) {
1826         goto err;
1827     }
1828 
1829     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
1830                                                  &has_cvq, errp);
1831     if (queue_pairs < 0) {
1832         qemu_close(vdpa_device_fd);
1833         return queue_pairs;
1834     }
1835 
1836     r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
1837     if (unlikely(r < 0)) {
1838         error_setg(errp, "vhost-vdpa: get iova range failed: %s",
1839                    strerror(-r));
1840         goto err;
1841     }
1842 
1843     if (opts->x_svq && !vhost_vdpa_net_valid_svq_features(features, errp)) {
1844         goto err;
1845     }
1846 
1847     ncs = g_malloc0(sizeof(*ncs) * queue_pairs);
1848 
1849     for (i = 0; i < queue_pairs; i++) {
1850         VhostVDPAShared *shared = NULL;
1851 
1852         if (i) {
1853             shared = DO_UPCAST(VhostVDPAState, nc, ncs[0])->vhost_vdpa.shared;
1854         }
1855         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1856                                      vdpa_device_fd, i, 2, true, opts->x_svq,
1857                                      iova_range, features, shared, errp);
1858         if (!ncs[i])
1859             goto err;
1860     }
1861 
1862     if (has_cvq) {
1863         VhostVDPAState *s0 = DO_UPCAST(VhostVDPAState, nc, ncs[0]);
1864         VhostVDPAShared *shared = s0->vhost_vdpa.shared;
1865 
1866         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1867                                  vdpa_device_fd, i, 1, false,
1868                                  opts->x_svq, iova_range, features, shared,
1869                                  errp);
1870         if (!nc)
1871             goto err;
1872     }
1873 
1874     return 0;
1875 
1876 err:
1877     if (i) {
1878         for (i--; i >= 0; i--) {
1879             qemu_del_net_client(ncs[i]);
1880         }
1881     }
1882 
1883     qemu_close(vdpa_device_fd);
1884 
1885     return -1;
1886 }
1887