xref: /openbmc/qemu/net/vhost-vdpa.c (revision bd38794a1119ec8e3f0a7473458ce4cdd229bc42)
1 /*
2  * vhost-vdpa.c
3  *
4  * Copyright(c) 2017-2018 Intel Corporation.
5  * Copyright(c) 2020 Red Hat, Inc.
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or later.
8  * See the COPYING file in the top-level directory.
9  *
10  */
11 
12 #include "qemu/osdep.h"
13 #include "clients.h"
14 #include "hw/virtio/virtio-net.h"
15 #include "net/vhost_net.h"
16 #include "net/vhost-vdpa.h"
17 #include "hw/virtio/vhost-vdpa.h"
18 #include "qemu/config-file.h"
19 #include "qemu/error-report.h"
20 #include "qemu/log.h"
21 #include "qemu/memalign.h"
22 #include "qemu/option.h"
23 #include "qapi/error.h"
24 #include <linux/vhost.h>
25 #include <sys/ioctl.h>
26 #include <err.h>
27 #include "standard-headers/linux/virtio_net.h"
28 #include "monitor/monitor.h"
29 #include "migration/misc.h"
30 #include "hw/virtio/vhost.h"
31 #include "trace.h"
32 
33 /* Todo:need to add the multiqueue support here */
34 typedef struct VhostVDPAState {
35     NetClientState nc;
36     struct vhost_vdpa vhost_vdpa;
37     NotifierWithReturn migration_state;
38     VHostNetState *vhost_net;
39 
40     /* Control commands shadow buffers */
41     void *cvq_cmd_out_buffer;
42     virtio_net_ctrl_ack *status;
43 
44     /* The device always have SVQ enabled */
45     bool always_svq;
46 
47     /* The device can isolate CVQ in its own ASID */
48     bool cvq_isolated;
49 
50     bool started;
51 } VhostVDPAState;
52 
53 /*
54  * The array is sorted alphabetically in ascending order,
55  * with the exception of VHOST_INVALID_FEATURE_BIT,
56  * which should always be the last entry.
57  */
58 static const int vdpa_feature_bits[] = {
59     VIRTIO_F_ANY_LAYOUT,
60     VIRTIO_F_IOMMU_PLATFORM,
61     VIRTIO_F_NOTIFY_ON_EMPTY,
62     VIRTIO_F_RING_PACKED,
63     VIRTIO_F_RING_RESET,
64     VIRTIO_F_VERSION_1,
65     VIRTIO_F_IN_ORDER,
66     VIRTIO_F_NOTIFICATION_DATA,
67     VIRTIO_NET_F_CSUM,
68     VIRTIO_NET_F_CTRL_GUEST_OFFLOADS,
69     VIRTIO_NET_F_CTRL_MAC_ADDR,
70     VIRTIO_NET_F_CTRL_RX,
71     VIRTIO_NET_F_CTRL_RX_EXTRA,
72     VIRTIO_NET_F_CTRL_VLAN,
73     VIRTIO_NET_F_CTRL_VQ,
74     VIRTIO_NET_F_GSO,
75     VIRTIO_NET_F_GUEST_CSUM,
76     VIRTIO_NET_F_GUEST_ECN,
77     VIRTIO_NET_F_GUEST_TSO4,
78     VIRTIO_NET_F_GUEST_TSO6,
79     VIRTIO_NET_F_GUEST_UFO,
80     VIRTIO_NET_F_GUEST_USO4,
81     VIRTIO_NET_F_GUEST_USO6,
82     VIRTIO_NET_F_HASH_REPORT,
83     VIRTIO_NET_F_HOST_ECN,
84     VIRTIO_NET_F_HOST_TSO4,
85     VIRTIO_NET_F_HOST_TSO6,
86     VIRTIO_NET_F_HOST_UFO,
87     VIRTIO_NET_F_HOST_USO,
88     VIRTIO_NET_F_MQ,
89     VIRTIO_NET_F_MRG_RXBUF,
90     VIRTIO_NET_F_MTU,
91     VIRTIO_NET_F_RSC_EXT,
92     VIRTIO_NET_F_RSS,
93     VIRTIO_NET_F_STATUS,
94     VIRTIO_RING_F_EVENT_IDX,
95     VIRTIO_RING_F_INDIRECT_DESC,
96 
97     /* VHOST_INVALID_FEATURE_BIT should always be the last entry */
98     VHOST_INVALID_FEATURE_BIT
99 };
100 
101 /** Supported device specific feature bits with SVQ */
102 static const uint64_t vdpa_svq_device_features =
103     BIT_ULL(VIRTIO_NET_F_CSUM) |
104     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
105     BIT_ULL(VIRTIO_NET_F_CTRL_GUEST_OFFLOADS) |
106     BIT_ULL(VIRTIO_NET_F_MTU) |
107     BIT_ULL(VIRTIO_NET_F_MAC) |
108     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |
109     BIT_ULL(VIRTIO_NET_F_GUEST_TSO6) |
110     BIT_ULL(VIRTIO_NET_F_GUEST_ECN) |
111     BIT_ULL(VIRTIO_NET_F_GUEST_UFO) |
112     BIT_ULL(VIRTIO_NET_F_HOST_TSO4) |
113     BIT_ULL(VIRTIO_NET_F_HOST_TSO6) |
114     BIT_ULL(VIRTIO_NET_F_HOST_ECN) |
115     BIT_ULL(VIRTIO_NET_F_HOST_UFO) |
116     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
117     BIT_ULL(VIRTIO_NET_F_STATUS) |
118     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
119     BIT_ULL(VIRTIO_NET_F_CTRL_RX) |
120     BIT_ULL(VIRTIO_NET_F_CTRL_VLAN) |
121     BIT_ULL(VIRTIO_NET_F_CTRL_RX_EXTRA) |
122     BIT_ULL(VIRTIO_NET_F_MQ) |
123     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
124     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |
125     /* VHOST_F_LOG_ALL is exposed by SVQ */
126     BIT_ULL(VHOST_F_LOG_ALL) |
127     BIT_ULL(VIRTIO_NET_F_HASH_REPORT) |
128     BIT_ULL(VIRTIO_NET_F_RSS) |
129     BIT_ULL(VIRTIO_NET_F_RSC_EXT) |
130     BIT_ULL(VIRTIO_NET_F_STANDBY) |
131     BIT_ULL(VIRTIO_NET_F_SPEED_DUPLEX);
132 
133 #define VHOST_VDPA_NET_CVQ_ASID 1
134 
135 static struct vhost_net *vhost_vdpa_get_vhost_net(NetClientState *nc)
136 {
137     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
138     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
139     return s->vhost_net;
140 }
141 
142 static size_t vhost_vdpa_net_cvq_cmd_len(void)
143 {
144     /*
145      * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
146      * In buffer is always 1 byte, so it should fit here
147      */
148     return sizeof(struct virtio_net_ctrl_hdr) +
149            2 * sizeof(struct virtio_net_ctrl_mac) +
150            MAC_TABLE_ENTRIES * ETH_ALEN;
151 }
152 
153 static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
154 {
155     return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
156 }
157 
158 static bool vhost_vdpa_net_valid_svq_features(uint64_t features, Error **errp)
159 {
160     uint64_t invalid_dev_features =
161         features & ~vdpa_svq_device_features &
162         /* Transport are all accepted at this point */
163         ~MAKE_64BIT_MASK(VIRTIO_TRANSPORT_F_START,
164                          VIRTIO_TRANSPORT_F_END - VIRTIO_TRANSPORT_F_START);
165 
166     if (invalid_dev_features) {
167         error_setg(errp, "vdpa svq does not work with features 0x%" PRIx64,
168                    invalid_dev_features);
169         return false;
170     }
171 
172     return vhost_svq_valid_features(features, errp);
173 }
174 
175 static int vhost_vdpa_net_check_device_id(struct vhost_net *net)
176 {
177     uint32_t device_id;
178     int ret;
179     struct vhost_dev *hdev;
180 
181     hdev = (struct vhost_dev *)&net->dev;
182     ret = hdev->vhost_ops->vhost_get_device_id(hdev, &device_id);
183     if (device_id != VIRTIO_ID_NET) {
184         return -ENOTSUP;
185     }
186     return ret;
187 }
188 
189 static int vhost_vdpa_add(NetClientState *ncs, void *be,
190                           int queue_pair_index, int nvqs)
191 {
192     VhostNetOptions options;
193     struct vhost_net *net = NULL;
194     VhostVDPAState *s;
195     int ret;
196 
197     options.backend_type = VHOST_BACKEND_TYPE_VDPA;
198     assert(ncs->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
199     s = DO_UPCAST(VhostVDPAState, nc, ncs);
200     options.net_backend = ncs;
201     options.opaque      = be;
202     options.busyloop_timeout = 0;
203     options.nvqs = nvqs;
204     options.feature_bits = vdpa_feature_bits;
205     options.get_acked_features = NULL;
206 
207     net = vhost_net_init(&options);
208     if (!net) {
209         error_report("failed to init vhost_net for queue");
210         goto err_init;
211     }
212     s->vhost_net = net;
213     ret = vhost_vdpa_net_check_device_id(net);
214     if (ret) {
215         goto err_check;
216     }
217     return 0;
218 err_check:
219     vhost_net_cleanup(net);
220     g_free(net);
221 err_init:
222     return -1;
223 }
224 
225 static void vhost_vdpa_cleanup(NetClientState *nc)
226 {
227     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
228 
229     munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
230     munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
231     if (s->vhost_net) {
232         vhost_net_cleanup(s->vhost_net);
233         g_free(s->vhost_net);
234         s->vhost_net = NULL;
235     }
236     if (s->vhost_vdpa.index != 0) {
237         return;
238     }
239     qemu_close(s->vhost_vdpa.shared->device_fd);
240     g_clear_pointer(&s->vhost_vdpa.shared->iova_tree, vhost_iova_tree_delete);
241     g_free(s->vhost_vdpa.shared);
242 }
243 
244 /** Dummy SetSteeringEBPF to support RSS for vhost-vdpa backend  */
245 static bool vhost_vdpa_set_steering_ebpf(NetClientState *nc, int prog_fd)
246 {
247     return true;
248 }
249 
250 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
251 {
252     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
253 
254     return true;
255 }
256 
257 static bool vhost_vdpa_has_ufo(NetClientState *nc)
258 {
259     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
260     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
261     uint64_t features = 0;
262     features |= (1ULL << VIRTIO_NET_F_HOST_UFO);
263     features = vhost_net_get_features(s->vhost_net, features);
264     return !!(features & (1ULL << VIRTIO_NET_F_HOST_UFO));
265 
266 }
267 
268 /*
269  * FIXME: vhost_vdpa doesn't have an API to "set h/w endianness". But it's
270  * reasonable to assume that h/w is LE by default, because LE is what
271  * virtio 1.0 and later ask for. So, this function just says "yes, the h/w is
272  * LE". Otherwise, on a BE machine, higher-level code would mistakely think
273  * the h/w is BE and can't support VDPA for a virtio 1.0 client.
274  */
275 static int vhost_vdpa_set_vnet_le(NetClientState *nc, bool enable)
276 {
277     return 0;
278 }
279 
280 static bool vhost_vdpa_check_peer_type(NetClientState *nc, ObjectClass *oc,
281                                        Error **errp)
282 {
283     const char *driver = object_class_get_name(oc);
284 
285     if (!g_str_has_prefix(driver, "virtio-net-")) {
286         error_setg(errp, "vhost-vdpa requires frontend driver virtio-net-*");
287         return false;
288     }
289 
290     return true;
291 }
292 
293 /** Dummy receive in case qemu falls back to userland tap networking */
294 static ssize_t vhost_vdpa_receive(NetClientState *nc, const uint8_t *buf,
295                                   size_t size)
296 {
297     return size;
298 }
299 
300 
301 /** From any vdpa net client, get the netclient of the i-th queue pair */
302 static VhostVDPAState *vhost_vdpa_net_get_nc_vdpa(VhostVDPAState *s, int i)
303 {
304     NICState *nic = qemu_get_nic(s->nc.peer);
305     NetClientState *nc_i = qemu_get_peer(nic->ncs, i);
306 
307     return DO_UPCAST(VhostVDPAState, nc, nc_i);
308 }
309 
310 static VhostVDPAState *vhost_vdpa_net_first_nc_vdpa(VhostVDPAState *s)
311 {
312     return vhost_vdpa_net_get_nc_vdpa(s, 0);
313 }
314 
315 static void vhost_vdpa_net_log_global_enable(VhostVDPAState *s, bool enable)
316 {
317     struct vhost_vdpa *v = &s->vhost_vdpa;
318     VirtIONet *n;
319     VirtIODevice *vdev;
320     int data_queue_pairs, cvq, r;
321 
322     /* We are only called on the first data vqs and only if x-svq is not set */
323     if (s->vhost_vdpa.shadow_vqs_enabled == enable) {
324         return;
325     }
326 
327     vdev = v->dev->vdev;
328     n = VIRTIO_NET(vdev);
329     if (!n->vhost_started) {
330         return;
331     }
332 
333     data_queue_pairs = n->multiqueue ? n->max_queue_pairs : 1;
334     cvq = virtio_vdev_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) ?
335                                   n->max_ncs - n->max_queue_pairs : 0;
336     v->shared->svq_switching = enable ?
337         SVQ_TSTATE_ENABLING : SVQ_TSTATE_DISABLING;
338     /*
339      * TODO: vhost_net_stop does suspend, get_base and reset. We can be smarter
340      * in the future and resume the device if read-only operations between
341      * suspend and reset goes wrong.
342      */
343     vhost_net_stop(vdev, n->nic->ncs, data_queue_pairs, cvq);
344 
345     /* Start will check migration setup_or_active to configure or not SVQ */
346     r = vhost_net_start(vdev, n->nic->ncs, data_queue_pairs, cvq);
347     if (unlikely(r < 0)) {
348         error_report("unable to start vhost net: %s(%d)", g_strerror(-r), -r);
349     }
350     v->shared->svq_switching = SVQ_TSTATE_DONE;
351 }
352 
353 static int vdpa_net_migration_state_notifier(NotifierWithReturn *notifier,
354                                              MigrationEvent *e, Error **errp)
355 {
356     VhostVDPAState *s = container_of(notifier, VhostVDPAState, migration_state);
357 
358     if (e->type == MIG_EVENT_PRECOPY_SETUP) {
359         vhost_vdpa_net_log_global_enable(s, true);
360     } else if (e->type == MIG_EVENT_PRECOPY_FAILED) {
361         vhost_vdpa_net_log_global_enable(s, false);
362     }
363     return 0;
364 }
365 
366 static void vhost_vdpa_net_data_start_first(VhostVDPAState *s)
367 {
368     migration_add_notifier(&s->migration_state,
369                            vdpa_net_migration_state_notifier);
370 }
371 
372 static int vhost_vdpa_net_data_start(NetClientState *nc)
373 {
374     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
375     struct vhost_vdpa *v = &s->vhost_vdpa;
376 
377     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
378 
379     if (s->always_svq || migration_is_running()) {
380         v->shadow_vqs_enabled = true;
381     } else {
382         v->shadow_vqs_enabled = false;
383     }
384 
385     if (v->index == 0) {
386         v->shared->shadow_data = v->shadow_vqs_enabled;
387         vhost_vdpa_net_data_start_first(s);
388         return 0;
389     }
390 
391     return 0;
392 }
393 
394 static int vhost_vdpa_net_data_load(NetClientState *nc)
395 {
396     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
397     struct vhost_vdpa *v = &s->vhost_vdpa;
398     bool has_cvq = v->dev->vq_index_end % 2;
399 
400     if (has_cvq) {
401         return 0;
402     }
403 
404     for (int i = 0; i < v->dev->nvqs; ++i) {
405         int ret = vhost_vdpa_set_vring_ready(v, i + v->dev->vq_index);
406         if (ret < 0) {
407             return ret;
408         }
409     }
410     return 0;
411 }
412 
413 static void vhost_vdpa_net_client_stop(NetClientState *nc)
414 {
415     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
416 
417     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
418 
419     if (s->vhost_vdpa.index == 0) {
420         migration_remove_notifier(&s->migration_state);
421     }
422 }
423 
424 static NetClientInfo net_vhost_vdpa_info = {
425         .type = NET_CLIENT_DRIVER_VHOST_VDPA,
426         .size = sizeof(VhostVDPAState),
427         .receive = vhost_vdpa_receive,
428         .start = vhost_vdpa_net_data_start,
429         .load = vhost_vdpa_net_data_load,
430         .stop = vhost_vdpa_net_client_stop,
431         .cleanup = vhost_vdpa_cleanup,
432         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
433         .has_ufo = vhost_vdpa_has_ufo,
434         .set_vnet_le = vhost_vdpa_set_vnet_le,
435         .check_peer_type = vhost_vdpa_check_peer_type,
436         .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
437         .get_vhost_net = vhost_vdpa_get_vhost_net,
438 };
439 
440 static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
441                                           Error **errp)
442 {
443     struct vhost_vring_state state = {
444         .index = vq_index,
445     };
446     int r = ioctl(device_fd, VHOST_VDPA_GET_VRING_GROUP, &state);
447 
448     if (unlikely(r < 0)) {
449         r = -errno;
450         error_setg_errno(errp, errno, "Cannot get VQ %u group", vq_index);
451         return r;
452     }
453 
454     return state.num;
455 }
456 
457 static int vhost_vdpa_set_address_space_id(struct vhost_vdpa *v,
458                                            unsigned vq_group,
459                                            unsigned asid_num)
460 {
461     struct vhost_vring_state asid = {
462         .index = vq_group,
463         .num = asid_num,
464     };
465     int r;
466 
467     trace_vhost_vdpa_set_address_space_id(v, vq_group, asid_num);
468 
469     r = ioctl(v->shared->device_fd, VHOST_VDPA_SET_GROUP_ASID, &asid);
470     if (unlikely(r < 0)) {
471         error_report("Can't set vq group %u asid %u, errno=%d (%s)",
472                      asid.index, asid.num, errno, g_strerror(errno));
473     }
474     return r;
475 }
476 
477 static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
478 {
479     VhostIOVATree *tree = v->shared->iova_tree;
480     DMAMap needle = {
481         /*
482          * No need to specify size or to look for more translations since
483          * this contiguous chunk was allocated by us.
484          */
485         .translated_addr = (hwaddr)(uintptr_t)addr,
486     };
487     const DMAMap *map = vhost_iova_tree_find_iova(tree, &needle);
488     int r;
489 
490     if (unlikely(!map)) {
491         error_report("Cannot locate expected map");
492         return;
493     }
494 
495     r = vhost_vdpa_dma_unmap(v->shared, v->address_space_id, map->iova,
496                              map->size + 1);
497     if (unlikely(r != 0)) {
498         error_report("Device cannot unmap: %s(%d)", g_strerror(r), r);
499     }
500 
501     vhost_iova_tree_remove(tree, *map);
502 }
503 
504 /** Map CVQ buffer. */
505 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
506                                   bool write)
507 {
508     DMAMap map = {};
509     hwaddr taddr = (hwaddr)(uintptr_t)buf;
510     int r;
511 
512     map.size = size - 1;
513     map.perm = write ? IOMMU_RW : IOMMU_RO,
514     r = vhost_iova_tree_map_alloc(v->shared->iova_tree, &map, taddr);
515     if (unlikely(r != IOVA_OK)) {
516         error_report("Cannot map injected element");
517 
518         if (map.translated_addr == taddr) {
519             error_report("Insertion to IOVA->HVA tree failed");
520             /* Remove the mapping from the IOVA-only tree */
521             goto dma_map_err;
522         }
523         return r;
524     }
525 
526     r = vhost_vdpa_dma_map(v->shared, v->address_space_id, map.iova,
527                            vhost_vdpa_net_cvq_cmd_page_len(), buf, !write);
528     if (unlikely(r < 0)) {
529         goto dma_map_err;
530     }
531 
532     return 0;
533 
534 dma_map_err:
535     vhost_iova_tree_remove(v->shared->iova_tree, map);
536     return r;
537 }
538 
539 static int vhost_vdpa_net_cvq_start(NetClientState *nc)
540 {
541     VhostVDPAState *s, *s0;
542     struct vhost_vdpa *v;
543     int64_t cvq_group;
544     int r;
545     Error *err = NULL;
546 
547     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
548 
549     s = DO_UPCAST(VhostVDPAState, nc, nc);
550     v = &s->vhost_vdpa;
551 
552     s0 = vhost_vdpa_net_first_nc_vdpa(s);
553     v->shadow_vqs_enabled = s0->vhost_vdpa.shadow_vqs_enabled;
554     s->vhost_vdpa.address_space_id = VHOST_VDPA_GUEST_PA_ASID;
555 
556     if (v->shared->shadow_data) {
557         /* SVQ is already configured for all virtqueues */
558         goto out;
559     }
560 
561     /*
562      * If we early return in these cases SVQ will not be enabled. The migration
563      * will be blocked as long as vhost-vdpa backends will not offer _F_LOG.
564      */
565     if (!vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
566         return 0;
567     }
568 
569     if (!s->cvq_isolated) {
570         return 0;
571     }
572 
573     cvq_group = vhost_vdpa_get_vring_group(v->shared->device_fd,
574                                            v->dev->vq_index_end - 1,
575                                            &err);
576     if (unlikely(cvq_group < 0)) {
577         error_report_err(err);
578         return cvq_group;
579     }
580 
581     r = vhost_vdpa_set_address_space_id(v, cvq_group, VHOST_VDPA_NET_CVQ_ASID);
582     if (unlikely(r < 0)) {
583         return r;
584     }
585 
586     v->shadow_vqs_enabled = true;
587     s->vhost_vdpa.address_space_id = VHOST_VDPA_NET_CVQ_ASID;
588 
589 out:
590     if (!s->vhost_vdpa.shadow_vqs_enabled) {
591         return 0;
592     }
593 
594     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
595                                vhost_vdpa_net_cvq_cmd_page_len(), false);
596     if (unlikely(r < 0)) {
597         return r;
598     }
599 
600     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->status,
601                                vhost_vdpa_net_cvq_cmd_page_len(), true);
602     if (unlikely(r < 0)) {
603         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
604     }
605 
606     return r;
607 }
608 
609 static void vhost_vdpa_net_cvq_stop(NetClientState *nc)
610 {
611     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
612 
613     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
614 
615     if (s->vhost_vdpa.shadow_vqs_enabled) {
616         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
617         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->status);
618     }
619 
620     vhost_vdpa_net_client_stop(nc);
621 }
622 
623 static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s,
624                                     const struct iovec *out_sg, size_t out_num,
625                                     const struct iovec *in_sg, size_t in_num)
626 {
627     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
628     int r;
629 
630     r = vhost_svq_add(svq, out_sg, out_num, NULL, in_sg, in_num, NULL, NULL);
631     if (unlikely(r != 0)) {
632         if (unlikely(r == -ENOSPC)) {
633             qemu_log_mask(LOG_GUEST_ERROR, "%s: No space on device queue\n",
634                           __func__);
635         }
636     }
637 
638     return r;
639 }
640 
641 /*
642  * Convenience wrapper to poll SVQ for multiple control commands.
643  *
644  * Caller should hold the BQL when invoking this function, and should take
645  * the answer before SVQ pulls by itself when BQL is released.
646  */
647 static ssize_t vhost_vdpa_net_svq_poll(VhostVDPAState *s, size_t cmds_in_flight)
648 {
649     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
650     return vhost_svq_poll(svq, cmds_in_flight);
651 }
652 
653 static void vhost_vdpa_net_load_cursor_reset(VhostVDPAState *s,
654                                              struct iovec *out_cursor,
655                                              struct iovec *in_cursor)
656 {
657     /* reset the cursor of the output buffer for the device */
658     out_cursor->iov_base = s->cvq_cmd_out_buffer;
659     out_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
660 
661     /* reset the cursor of the in buffer for the device */
662     in_cursor->iov_base = s->status;
663     in_cursor->iov_len = vhost_vdpa_net_cvq_cmd_page_len();
664 }
665 
666 /*
667  * Poll SVQ for multiple pending control commands and check the device's ack.
668  *
669  * Caller should hold the BQL when invoking this function.
670  *
671  * @s: The VhostVDPAState
672  * @len: The length of the pending status shadow buffer
673  */
674 static ssize_t vhost_vdpa_net_svq_flush(VhostVDPAState *s, size_t len)
675 {
676     /* device uses a one-byte length ack for each control command */
677     ssize_t dev_written = vhost_vdpa_net_svq_poll(s, len);
678     if (unlikely(dev_written != len)) {
679         return -EIO;
680     }
681 
682     /* check the device's ack */
683     for (int i = 0; i < len; ++i) {
684         if (s->status[i] != VIRTIO_NET_OK) {
685             return -EIO;
686         }
687     }
688     return 0;
689 }
690 
691 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s,
692                                        struct iovec *out_cursor,
693                                        struct iovec *in_cursor, uint8_t class,
694                                        uint8_t cmd, const struct iovec *data_sg,
695                                        size_t data_num)
696 {
697     const struct virtio_net_ctrl_hdr ctrl = {
698         .class = class,
699         .cmd = cmd,
700     };
701     size_t data_size = iov_size(data_sg, data_num), cmd_size;
702     struct iovec out, in;
703     ssize_t r;
704     unsigned dummy_cursor_iov_cnt;
705     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
706 
707     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
708     cmd_size = sizeof(ctrl) + data_size;
709     trace_vhost_vdpa_net_load_cmd(s, class, cmd, data_num, data_size);
710     if (vhost_svq_available_slots(svq) < 2 ||
711         iov_size(out_cursor, 1) < cmd_size) {
712         /*
713          * It is time to flush all pending control commands if SVQ is full
714          * or control commands shadow buffers are full.
715          *
716          * We can poll here since we've had BQL from the time
717          * we sent the descriptor.
718          */
719         r = vhost_vdpa_net_svq_flush(s, in_cursor->iov_base -
720                                      (void *)s->status);
721         if (unlikely(r < 0)) {
722             return r;
723         }
724 
725         vhost_vdpa_net_load_cursor_reset(s, out_cursor, in_cursor);
726     }
727 
728     /* pack the CVQ command header */
729     iov_from_buf(out_cursor, 1, 0, &ctrl, sizeof(ctrl));
730     /* pack the CVQ command command-specific-data */
731     iov_to_buf(data_sg, data_num, 0,
732                out_cursor->iov_base + sizeof(ctrl), data_size);
733 
734     /* extract the required buffer from the cursor for output */
735     iov_copy(&out, 1, out_cursor, 1, 0, cmd_size);
736     /* extract the required buffer from the cursor for input */
737     iov_copy(&in, 1, in_cursor, 1, 0, sizeof(*s->status));
738 
739     r = vhost_vdpa_net_cvq_add(s, &out, 1, &in, 1);
740     if (unlikely(r < 0)) {
741         trace_vhost_vdpa_net_load_cmd_retval(s, class, cmd, r);
742         return r;
743     }
744 
745     /* iterate the cursors */
746     dummy_cursor_iov_cnt = 1;
747     iov_discard_front(&out_cursor, &dummy_cursor_iov_cnt, cmd_size);
748     dummy_cursor_iov_cnt = 1;
749     iov_discard_front(&in_cursor, &dummy_cursor_iov_cnt, sizeof(*s->status));
750 
751     return 0;
752 }
753 
754 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n,
755                                    struct iovec *out_cursor,
756                                    struct iovec *in_cursor)
757 {
758     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
759         const struct iovec data = {
760             .iov_base = (void *)n->mac,
761             .iov_len = sizeof(n->mac),
762         };
763         ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
764                                             VIRTIO_NET_CTRL_MAC,
765                                             VIRTIO_NET_CTRL_MAC_ADDR_SET,
766                                             &data, 1);
767         if (unlikely(r < 0)) {
768             return r;
769         }
770     }
771 
772     /*
773      * According to VirtIO standard, "The device MUST have an
774      * empty MAC filtering table on reset.".
775      *
776      * Therefore, there is no need to send this CVQ command if the
777      * driver also sets an empty MAC filter table, which aligns with
778      * the device's defaults.
779      *
780      * Note that the device's defaults can mismatch the driver's
781      * configuration only at live migration.
782      */
783     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX) ||
784         n->mac_table.in_use == 0) {
785         return 0;
786     }
787 
788     uint32_t uni_entries = n->mac_table.first_multi,
789              uni_macs_size = uni_entries * ETH_ALEN,
790              mul_entries = n->mac_table.in_use - uni_entries,
791              mul_macs_size = mul_entries * ETH_ALEN;
792     struct virtio_net_ctrl_mac uni = {
793         .entries = cpu_to_le32(uni_entries),
794     };
795     struct virtio_net_ctrl_mac mul = {
796         .entries = cpu_to_le32(mul_entries),
797     };
798     const struct iovec data[] = {
799         {
800             .iov_base = &uni,
801             .iov_len = sizeof(uni),
802         }, {
803             .iov_base = n->mac_table.macs,
804             .iov_len = uni_macs_size,
805         }, {
806             .iov_base = &mul,
807             .iov_len = sizeof(mul),
808         }, {
809             .iov_base = &n->mac_table.macs[uni_macs_size],
810             .iov_len = mul_macs_size,
811         },
812     };
813     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
814                                         VIRTIO_NET_CTRL_MAC,
815                                         VIRTIO_NET_CTRL_MAC_TABLE_SET,
816                                         data, ARRAY_SIZE(data));
817     if (unlikely(r < 0)) {
818         return r;
819     }
820 
821     return 0;
822 }
823 
824 static int vhost_vdpa_net_load_rss(VhostVDPAState *s, const VirtIONet *n,
825                                    struct iovec *out_cursor,
826                                    struct iovec *in_cursor, bool do_rss)
827 {
828     struct virtio_net_rss_config cfg = {};
829     ssize_t r;
830     g_autofree uint16_t *table = NULL;
831 
832     /*
833      * According to VirtIO standard, "Initially the device has all hash
834      * types disabled and reports only VIRTIO_NET_HASH_REPORT_NONE.".
835      *
836      * Therefore, there is no need to send this CVQ command if the
837      * driver disables the all hash types, which aligns with
838      * the device's defaults.
839      *
840      * Note that the device's defaults can mismatch the driver's
841      * configuration only at live migration.
842      */
843     if (!n->rss_data.enabled ||
844         n->rss_data.hash_types == VIRTIO_NET_HASH_REPORT_NONE) {
845         return 0;
846     }
847 
848     table = g_malloc_n(n->rss_data.indirections_len,
849                        sizeof(n->rss_data.indirections_table[0]));
850     cfg.hash_types = cpu_to_le32(n->rss_data.hash_types);
851 
852     if (do_rss) {
853         /*
854          * According to VirtIO standard, "Number of entries in indirection_table
855          * is (indirection_table_mask + 1)".
856          */
857         cfg.indirection_table_mask = cpu_to_le16(n->rss_data.indirections_len -
858                                                  1);
859         cfg.unclassified_queue = cpu_to_le16(n->rss_data.default_queue);
860         for (int i = 0; i < n->rss_data.indirections_len; ++i) {
861             table[i] = cpu_to_le16(n->rss_data.indirections_table[i]);
862         }
863         cfg.max_tx_vq = cpu_to_le16(n->curr_queue_pairs);
864     } else {
865         /*
866          * According to VirtIO standard, "Field reserved MUST contain zeroes.
867          * It is defined to make the structure to match the layout of
868          * virtio_net_rss_config structure, defined in 5.1.6.5.7.".
869          *
870          * Therefore, we need to zero the fields in
871          * struct virtio_net_rss_config, which corresponds to the
872          * `reserved` field in struct virtio_net_hash_config.
873          *
874          * Note that all other fields are zeroed at their definitions,
875          * except for the `indirection_table` field, where the actual data
876          * is stored in the `table` variable to ensure compatibility
877          * with RSS case. Therefore, we need to zero the `table` variable here.
878          */
879         table[0] = 0;
880     }
881 
882     /*
883      * Considering that virtio_net_handle_rss() currently does not restore
884      * the hash key length parsed from the CVQ command sent from the guest
885      * into n->rss_data and uses the maximum key length in other code, so
886      * we also employ the maximum key length here.
887      */
888     cfg.hash_key_length = sizeof(n->rss_data.key);
889 
890     const struct iovec data[] = {
891         {
892             .iov_base = &cfg,
893             .iov_len = offsetof(struct virtio_net_rss_config,
894                                 indirection_table),
895         }, {
896             .iov_base = table,
897             .iov_len = n->rss_data.indirections_len *
898                        sizeof(n->rss_data.indirections_table[0]),
899         }, {
900             .iov_base = &cfg.max_tx_vq,
901             .iov_len = offsetof(struct virtio_net_rss_config, hash_key_data) -
902                        offsetof(struct virtio_net_rss_config, max_tx_vq),
903         }, {
904             .iov_base = (void *)n->rss_data.key,
905             .iov_len = sizeof(n->rss_data.key),
906         }
907     };
908 
909     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
910                                 VIRTIO_NET_CTRL_MQ,
911                                 do_rss ? VIRTIO_NET_CTRL_MQ_RSS_CONFIG :
912                                 VIRTIO_NET_CTRL_MQ_HASH_CONFIG,
913                                 data, ARRAY_SIZE(data));
914     if (unlikely(r < 0)) {
915         return r;
916     }
917 
918     return 0;
919 }
920 
921 static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
922                                   const VirtIONet *n,
923                                   struct iovec *out_cursor,
924                                   struct iovec *in_cursor)
925 {
926     struct virtio_net_ctrl_mq mq;
927     ssize_t r;
928 
929     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_MQ)) {
930         return 0;
931     }
932 
933     trace_vhost_vdpa_net_load_mq(s, n->curr_queue_pairs);
934 
935     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
936     const struct iovec data = {
937         .iov_base = &mq,
938         .iov_len = sizeof(mq),
939     };
940     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
941                                 VIRTIO_NET_CTRL_MQ,
942                                 VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET,
943                                 &data, 1);
944     if (unlikely(r < 0)) {
945         return r;
946     }
947 
948     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_RSS)) {
949         /* load the receive-side scaling state */
950         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, true);
951         if (unlikely(r < 0)) {
952             return r;
953         }
954     } else if (virtio_vdev_has_feature(&n->parent_obj,
955                                        VIRTIO_NET_F_HASH_REPORT)) {
956         /* load the hash calculation state */
957         r = vhost_vdpa_net_load_rss(s, n, out_cursor, in_cursor, false);
958         if (unlikely(r < 0)) {
959             return r;
960         }
961     }
962 
963     return 0;
964 }
965 
966 static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
967                                         const VirtIONet *n,
968                                         struct iovec *out_cursor,
969                                         struct iovec *in_cursor)
970 {
971     uint64_t offloads;
972     ssize_t r;
973 
974     if (!virtio_vdev_has_feature(&n->parent_obj,
975                                  VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) {
976         return 0;
977     }
978 
979     if (n->curr_guest_offloads == virtio_net_supported_guest_offloads(n)) {
980         /*
981          * According to VirtIO standard, "Upon feature negotiation
982          * corresponding offload gets enabled to preserve
983          * backward compatibility.".
984          *
985          * Therefore, there is no need to send this CVQ command if the
986          * driver also enables all supported offloads, which aligns with
987          * the device's defaults.
988          *
989          * Note that the device's defaults can mismatch the driver's
990          * configuration only at live migration.
991          */
992         return 0;
993     }
994 
995     offloads = cpu_to_le64(n->curr_guest_offloads);
996     const struct iovec data = {
997         .iov_base = &offloads,
998         .iov_len = sizeof(offloads),
999     };
1000     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1001                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS,
1002                                 VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET,
1003                                 &data, 1);
1004     if (unlikely(r < 0)) {
1005         return r;
1006     }
1007 
1008     return 0;
1009 }
1010 
1011 static int vhost_vdpa_net_load_rx_mode(VhostVDPAState *s,
1012                                        struct iovec *out_cursor,
1013                                        struct iovec *in_cursor,
1014                                        uint8_t cmd,
1015                                        uint8_t on)
1016 {
1017     const struct iovec data = {
1018         .iov_base = &on,
1019         .iov_len = sizeof(on),
1020     };
1021     ssize_t r;
1022 
1023     r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1024                                 VIRTIO_NET_CTRL_RX, cmd, &data, 1);
1025     if (unlikely(r < 0)) {
1026         return r;
1027     }
1028 
1029     return 0;
1030 }
1031 
1032 static int vhost_vdpa_net_load_rx(VhostVDPAState *s,
1033                                   const VirtIONet *n,
1034                                   struct iovec *out_cursor,
1035                                   struct iovec *in_cursor)
1036 {
1037     ssize_t r;
1038 
1039     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX)) {
1040         return 0;
1041     }
1042 
1043     /*
1044      * According to virtio_net_reset(), device turns promiscuous mode
1045      * on by default.
1046      *
1047      * Additionally, according to VirtIO standard, "Since there are
1048      * no guarantees, it can use a hash filter or silently switch to
1049      * allmulti or promiscuous mode if it is given too many addresses.".
1050      * QEMU marks `n->mac_table.uni_overflow` if guest sets too many
1051      * non-multicast MAC addresses, indicating that promiscuous mode
1052      * should be enabled.
1053      *
1054      * Therefore, QEMU should only send this CVQ command if the
1055      * `n->mac_table.uni_overflow` is not marked and `n->promisc` is off,
1056      * which sets promiscuous mode on, different from the device's defaults.
1057      *
1058      * Note that the device's defaults can mismatch the driver's
1059      * configuration only at live migration.
1060      */
1061     if (!n->mac_table.uni_overflow && !n->promisc) {
1062         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1063                                         VIRTIO_NET_CTRL_RX_PROMISC, 0);
1064         if (unlikely(r < 0)) {
1065             return r;
1066         }
1067     }
1068 
1069     /*
1070      * According to virtio_net_reset(), device turns all-multicast mode
1071      * off by default.
1072      *
1073      * According to VirtIO standard, "Since there are no guarantees,
1074      * it can use a hash filter or silently switch to allmulti or
1075      * promiscuous mode if it is given too many addresses.". QEMU marks
1076      * `n->mac_table.multi_overflow` if guest sets too many
1077      * non-multicast MAC addresses.
1078      *
1079      * Therefore, QEMU should only send this CVQ command if the
1080      * `n->mac_table.multi_overflow` is marked or `n->allmulti` is on,
1081      * which sets all-multicast mode on, different from the device's defaults.
1082      *
1083      * Note that the device's defaults can mismatch the driver's
1084      * configuration only at live migration.
1085      */
1086     if (n->mac_table.multi_overflow || n->allmulti) {
1087         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1088                                         VIRTIO_NET_CTRL_RX_ALLMULTI, 1);
1089         if (unlikely(r < 0)) {
1090             return r;
1091         }
1092     }
1093 
1094     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX_EXTRA)) {
1095         return 0;
1096     }
1097 
1098     /*
1099      * According to virtio_net_reset(), device turns all-unicast mode
1100      * off by default.
1101      *
1102      * Therefore, QEMU should only send this CVQ command if the driver
1103      * sets all-unicast mode on, different from the device's defaults.
1104      *
1105      * Note that the device's defaults can mismatch the driver's
1106      * configuration only at live migration.
1107      */
1108     if (n->alluni) {
1109         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1110                                         VIRTIO_NET_CTRL_RX_ALLUNI, 1);
1111         if (r < 0) {
1112             return r;
1113         }
1114     }
1115 
1116     /*
1117      * According to virtio_net_reset(), device turns non-multicast mode
1118      * off by default.
1119      *
1120      * Therefore, QEMU should only send this CVQ command if the driver
1121      * sets non-multicast mode on, different from the device's defaults.
1122      *
1123      * Note that the device's defaults can mismatch the driver's
1124      * configuration only at live migration.
1125      */
1126     if (n->nomulti) {
1127         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1128                                         VIRTIO_NET_CTRL_RX_NOMULTI, 1);
1129         if (r < 0) {
1130             return r;
1131         }
1132     }
1133 
1134     /*
1135      * According to virtio_net_reset(), device turns non-unicast mode
1136      * off by default.
1137      *
1138      * Therefore, QEMU should only send this CVQ command if the driver
1139      * sets non-unicast mode on, different from the device's defaults.
1140      *
1141      * Note that the device's defaults can mismatch the driver's
1142      * configuration only at live migration.
1143      */
1144     if (n->nouni) {
1145         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1146                                         VIRTIO_NET_CTRL_RX_NOUNI, 1);
1147         if (r < 0) {
1148             return r;
1149         }
1150     }
1151 
1152     /*
1153      * According to virtio_net_reset(), device turns non-broadcast mode
1154      * off by default.
1155      *
1156      * Therefore, QEMU should only send this CVQ command if the driver
1157      * sets non-broadcast mode on, different from the device's defaults.
1158      *
1159      * Note that the device's defaults can mismatch the driver's
1160      * configuration only at live migration.
1161      */
1162     if (n->nobcast) {
1163         r = vhost_vdpa_net_load_rx_mode(s, out_cursor, in_cursor,
1164                                         VIRTIO_NET_CTRL_RX_NOBCAST, 1);
1165         if (r < 0) {
1166             return r;
1167         }
1168     }
1169 
1170     return 0;
1171 }
1172 
1173 static int vhost_vdpa_net_load_single_vlan(VhostVDPAState *s,
1174                                            const VirtIONet *n,
1175                                            struct iovec *out_cursor,
1176                                            struct iovec *in_cursor,
1177                                            uint16_t vid)
1178 {
1179     const struct iovec data = {
1180         .iov_base = &vid,
1181         .iov_len = sizeof(vid),
1182     };
1183     ssize_t r = vhost_vdpa_net_load_cmd(s, out_cursor, in_cursor,
1184                                         VIRTIO_NET_CTRL_VLAN,
1185                                         VIRTIO_NET_CTRL_VLAN_ADD,
1186                                         &data, 1);
1187     if (unlikely(r < 0)) {
1188         return r;
1189     }
1190 
1191     return 0;
1192 }
1193 
1194 static int vhost_vdpa_net_load_vlan(VhostVDPAState *s,
1195                                     const VirtIONet *n,
1196                                     struct iovec *out_cursor,
1197                                     struct iovec *in_cursor)
1198 {
1199     int r;
1200 
1201     if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_VLAN)) {
1202         return 0;
1203     }
1204 
1205     for (int i = 0; i < MAX_VLAN >> 5; i++) {
1206         for (int j = 0; n->vlans[i] && j <= 0x1f; j++) {
1207             if (n->vlans[i] & (1U << j)) {
1208                 r = vhost_vdpa_net_load_single_vlan(s, n, out_cursor,
1209                                                     in_cursor, (i << 5) + j);
1210                 if (unlikely(r != 0)) {
1211                     return r;
1212                 }
1213             }
1214         }
1215     }
1216 
1217     return 0;
1218 }
1219 
1220 static int vhost_vdpa_net_cvq_load(NetClientState *nc)
1221 {
1222     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
1223     struct vhost_vdpa *v = &s->vhost_vdpa;
1224     const VirtIONet *n;
1225     int r;
1226     struct iovec out_cursor, in_cursor;
1227 
1228     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1229 
1230     r = vhost_vdpa_set_vring_ready(v, v->dev->vq_index);
1231     if (unlikely(r < 0)) {
1232         return r;
1233     }
1234 
1235     if (v->shadow_vqs_enabled) {
1236         n = VIRTIO_NET(v->dev->vdev);
1237         vhost_vdpa_net_load_cursor_reset(s, &out_cursor, &in_cursor);
1238         r = vhost_vdpa_net_load_mac(s, n, &out_cursor, &in_cursor);
1239         if (unlikely(r < 0)) {
1240             return r;
1241         }
1242         r = vhost_vdpa_net_load_mq(s, n, &out_cursor, &in_cursor);
1243         if (unlikely(r)) {
1244             return r;
1245         }
1246         r = vhost_vdpa_net_load_offloads(s, n, &out_cursor, &in_cursor);
1247         if (unlikely(r)) {
1248             return r;
1249         }
1250         r = vhost_vdpa_net_load_rx(s, n, &out_cursor, &in_cursor);
1251         if (unlikely(r)) {
1252             return r;
1253         }
1254         r = vhost_vdpa_net_load_vlan(s, n, &out_cursor, &in_cursor);
1255         if (unlikely(r)) {
1256             return r;
1257         }
1258 
1259         /*
1260          * We need to poll and check all pending device's used buffers.
1261          *
1262          * We can poll here since we've had BQL from the time
1263          * we sent the descriptor.
1264          */
1265         r = vhost_vdpa_net_svq_flush(s, in_cursor.iov_base - (void *)s->status);
1266         if (unlikely(r)) {
1267             return r;
1268         }
1269     }
1270 
1271     for (int i = 0; i < v->dev->vq_index; ++i) {
1272         r = vhost_vdpa_set_vring_ready(v, i);
1273         if (unlikely(r < 0)) {
1274             return r;
1275         }
1276     }
1277 
1278     return 0;
1279 }
1280 
1281 static NetClientInfo net_vhost_vdpa_cvq_info = {
1282     .type = NET_CLIENT_DRIVER_VHOST_VDPA,
1283     .size = sizeof(VhostVDPAState),
1284     .receive = vhost_vdpa_receive,
1285     .start = vhost_vdpa_net_cvq_start,
1286     .load = vhost_vdpa_net_cvq_load,
1287     .stop = vhost_vdpa_net_cvq_stop,
1288     .cleanup = vhost_vdpa_cleanup,
1289     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
1290     .has_ufo = vhost_vdpa_has_ufo,
1291     .check_peer_type = vhost_vdpa_check_peer_type,
1292     .set_steering_ebpf = vhost_vdpa_set_steering_ebpf,
1293     .get_vhost_net = vhost_vdpa_get_vhost_net,
1294 };
1295 
1296 /*
1297  * Forward the excessive VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command to
1298  * vdpa device.
1299  *
1300  * Considering that QEMU cannot send the entire filter table to the
1301  * vdpa device, it should send the VIRTIO_NET_CTRL_RX_PROMISC CVQ
1302  * command to enable promiscuous mode to receive all packets,
1303  * according to VirtIO standard, "Since there are no guarantees,
1304  * it can use a hash filter or silently switch to allmulti or
1305  * promiscuous mode if it is given too many addresses.".
1306  *
1307  * Since QEMU ignores MAC addresses beyond `MAC_TABLE_ENTRIES` and
1308  * marks `n->mac_table.x_overflow` accordingly, it should have
1309  * the same effect on the device model to receive
1310  * (`MAC_TABLE_ENTRIES` + 1) or more non-multicast MAC addresses.
1311  * The same applies to multicast MAC addresses.
1312  *
1313  * Therefore, QEMU can provide the device model with a fake
1314  * VIRTIO_NET_CTRL_MAC_TABLE_SET command with (`MAC_TABLE_ENTRIES` + 1)
1315  * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1) multicast
1316  * MAC addresses. This ensures that the device model marks
1317  * `n->mac_table.uni_overflow` and `n->mac_table.multi_overflow`,
1318  * allowing all packets to be received, which aligns with the
1319  * state of the vdpa device.
1320  */
1321 static int vhost_vdpa_net_excessive_mac_filter_cvq_add(VhostVDPAState *s,
1322                                                        VirtQueueElement *elem,
1323                                                        struct iovec *out,
1324                                                        const struct iovec *in)
1325 {
1326     struct virtio_net_ctrl_mac mac_data, *mac_ptr;
1327     struct virtio_net_ctrl_hdr *hdr_ptr;
1328     uint32_t cursor;
1329     ssize_t r;
1330     uint8_t on = 1;
1331 
1332     /* parse the non-multicast MAC address entries from CVQ command */
1333     cursor = sizeof(*hdr_ptr);
1334     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1335                    &mac_data, sizeof(mac_data));
1336     if (unlikely(r != sizeof(mac_data))) {
1337         /*
1338          * If the CVQ command is invalid, we should simulate the vdpa device
1339          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1340          */
1341         *s->status = VIRTIO_NET_ERR;
1342         return sizeof(*s->status);
1343     }
1344     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1345 
1346     /* parse the multicast MAC address entries from CVQ command */
1347     r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
1348                    &mac_data, sizeof(mac_data));
1349     if (r != sizeof(mac_data)) {
1350         /*
1351          * If the CVQ command is invalid, we should simulate the vdpa device
1352          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1353          */
1354         *s->status = VIRTIO_NET_ERR;
1355         return sizeof(*s->status);
1356     }
1357     cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
1358 
1359     /* validate the CVQ command */
1360     if (iov_size(elem->out_sg, elem->out_num) != cursor) {
1361         /*
1362          * If the CVQ command is invalid, we should simulate the vdpa device
1363          * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1364          */
1365         *s->status = VIRTIO_NET_ERR;
1366         return sizeof(*s->status);
1367     }
1368 
1369     /*
1370      * According to VirtIO standard, "Since there are no guarantees,
1371      * it can use a hash filter or silently switch to allmulti or
1372      * promiscuous mode if it is given too many addresses.".
1373      *
1374      * Therefore, considering that QEMU is unable to send the entire
1375      * filter table to the vdpa device, it should send the
1376      * VIRTIO_NET_CTRL_RX_PROMISC CVQ command to enable promiscuous mode
1377      */
1378     hdr_ptr = out->iov_base;
1379     out->iov_len = sizeof(*hdr_ptr) + sizeof(on);
1380 
1381     hdr_ptr->class = VIRTIO_NET_CTRL_RX;
1382     hdr_ptr->cmd = VIRTIO_NET_CTRL_RX_PROMISC;
1383     iov_from_buf(out, 1, sizeof(*hdr_ptr), &on, sizeof(on));
1384     r = vhost_vdpa_net_cvq_add(s, out, 1, in, 1);
1385     if (unlikely(r < 0)) {
1386         return r;
1387     }
1388 
1389     /*
1390      * We can poll here since we've had BQL from the time
1391      * we sent the descriptor.
1392      */
1393     r = vhost_vdpa_net_svq_poll(s, 1);
1394     if (unlikely(r < sizeof(*s->status))) {
1395         return r;
1396     }
1397     if (*s->status != VIRTIO_NET_OK) {
1398         return sizeof(*s->status);
1399     }
1400 
1401     /*
1402      * QEMU should also send a fake VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ
1403      * command to the device model, including (`MAC_TABLE_ENTRIES` + 1)
1404      * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1)
1405      * multicast MAC addresses.
1406      *
1407      * By doing so, the device model can mark `n->mac_table.uni_overflow`
1408      * and `n->mac_table.multi_overflow`, enabling all packets to be
1409      * received, which aligns with the state of the vdpa device.
1410      */
1411     cursor = 0;
1412     uint32_t fake_uni_entries = MAC_TABLE_ENTRIES + 1,
1413              fake_mul_entries = MAC_TABLE_ENTRIES + 1,
1414              fake_cvq_size = sizeof(struct virtio_net_ctrl_hdr) +
1415                              sizeof(mac_data) + fake_uni_entries * ETH_ALEN +
1416                              sizeof(mac_data) + fake_mul_entries * ETH_ALEN;
1417 
1418     assert(fake_cvq_size < vhost_vdpa_net_cvq_cmd_page_len());
1419     out->iov_len = fake_cvq_size;
1420 
1421     /* pack the header for fake CVQ command */
1422     hdr_ptr = out->iov_base + cursor;
1423     hdr_ptr->class = VIRTIO_NET_CTRL_MAC;
1424     hdr_ptr->cmd = VIRTIO_NET_CTRL_MAC_TABLE_SET;
1425     cursor += sizeof(*hdr_ptr);
1426 
1427     /*
1428      * Pack the non-multicast MAC addresses part for fake CVQ command.
1429      *
1430      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1431      * addresses provided in CVQ command. Therefore, only the entries
1432      * field need to be prepared in the CVQ command.
1433      */
1434     mac_ptr = out->iov_base + cursor;
1435     mac_ptr->entries = cpu_to_le32(fake_uni_entries);
1436     cursor += sizeof(*mac_ptr) + fake_uni_entries * ETH_ALEN;
1437 
1438     /*
1439      * Pack the multicast MAC addresses part for fake CVQ command.
1440      *
1441      * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
1442      * addresses provided in CVQ command. Therefore, only the entries
1443      * field need to be prepared in the CVQ command.
1444      */
1445     mac_ptr = out->iov_base + cursor;
1446     mac_ptr->entries = cpu_to_le32(fake_mul_entries);
1447 
1448     /*
1449      * Simulating QEMU poll a vdpa device used buffer
1450      * for VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
1451      */
1452     return sizeof(*s->status);
1453 }
1454 
1455 /**
1456  * Validate and copy control virtqueue commands.
1457  *
1458  * Following QEMU guidelines, we offer a copy of the buffers to the device to
1459  * prevent TOCTOU bugs.
1460  */
1461 static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
1462                                             VirtQueueElement *elem,
1463                                             void *opaque)
1464 {
1465     VhostVDPAState *s = opaque;
1466     size_t in_len;
1467     const struct virtio_net_ctrl_hdr *ctrl;
1468     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
1469     /* Out buffer sent to both the vdpa device and the device model */
1470     struct iovec out = {
1471         .iov_base = s->cvq_cmd_out_buffer,
1472     };
1473     /* in buffer used for device model */
1474     const struct iovec model_in = {
1475         .iov_base = &status,
1476         .iov_len = sizeof(status),
1477     };
1478     /* in buffer used for vdpa device */
1479     const struct iovec vdpa_in = {
1480         .iov_base = s->status,
1481         .iov_len = sizeof(*s->status),
1482     };
1483     ssize_t dev_written = -EINVAL;
1484 
1485     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
1486                              s->cvq_cmd_out_buffer,
1487                              vhost_vdpa_net_cvq_cmd_page_len());
1488 
1489     ctrl = s->cvq_cmd_out_buffer;
1490     if (ctrl->class == VIRTIO_NET_CTRL_ANNOUNCE) {
1491         /*
1492          * Guest announce capability is emulated by qemu, so don't forward to
1493          * the device.
1494          */
1495         dev_written = sizeof(status);
1496         *s->status = VIRTIO_NET_OK;
1497     } else if (unlikely(ctrl->class == VIRTIO_NET_CTRL_MAC &&
1498                         ctrl->cmd == VIRTIO_NET_CTRL_MAC_TABLE_SET &&
1499                         iov_size(elem->out_sg, elem->out_num) > out.iov_len)) {
1500         /*
1501          * Due to the size limitation of the out buffer sent to the vdpa device,
1502          * which is determined by vhost_vdpa_net_cvq_cmd_page_len(), excessive
1503          * MAC addresses set by the driver for the filter table can cause
1504          * truncation of the CVQ command in QEMU. As a result, the vdpa device
1505          * rejects the flawed CVQ command.
1506          *
1507          * Therefore, QEMU must handle this situation instead of sending
1508          * the CVQ command directly.
1509          */
1510         dev_written = vhost_vdpa_net_excessive_mac_filter_cvq_add(s, elem,
1511                                                             &out, &vdpa_in);
1512         if (unlikely(dev_written < 0)) {
1513             goto out;
1514         }
1515     } else {
1516         ssize_t r;
1517         r = vhost_vdpa_net_cvq_add(s, &out, 1, &vdpa_in, 1);
1518         if (unlikely(r < 0)) {
1519             dev_written = r;
1520             goto out;
1521         }
1522 
1523         /*
1524          * We can poll here since we've had BQL from the time
1525          * we sent the descriptor.
1526          */
1527         dev_written = vhost_vdpa_net_svq_poll(s, 1);
1528     }
1529 
1530     if (unlikely(dev_written < sizeof(status))) {
1531         error_report("Insufficient written data (%zu)", dev_written);
1532         goto out;
1533     }
1534 
1535     if (*s->status != VIRTIO_NET_OK) {
1536         goto out;
1537     }
1538 
1539     status = VIRTIO_NET_ERR;
1540     virtio_net_handle_ctrl_iov(svq->vdev, &model_in, 1, &out, 1);
1541     if (status != VIRTIO_NET_OK) {
1542         error_report("Bad CVQ processing in model");
1543     }
1544 
1545 out:
1546     in_len = iov_from_buf(elem->in_sg, elem->in_num, 0, &status,
1547                           sizeof(status));
1548     if (unlikely(in_len < sizeof(status))) {
1549         error_report("Bad device CVQ written length");
1550     }
1551     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
1552     /*
1553      * `elem` belongs to vhost_vdpa_net_handle_ctrl_avail() only when
1554      * the function successfully forwards the CVQ command, indicated
1555      * by a non-negative value of `dev_written`. Otherwise, it still
1556      * belongs to SVQ.
1557      * This function should only free the `elem` when it owns.
1558      */
1559     if (dev_written >= 0) {
1560         g_free(elem);
1561     }
1562     return dev_written < 0 ? dev_written : 0;
1563 }
1564 
1565 static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
1566     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
1567 };
1568 
1569 /**
1570  * Probe if CVQ is isolated
1571  *
1572  * @device_fd         The vdpa device fd
1573  * @features          Features offered by the device.
1574  * @cvq_index         The control vq pair index
1575  *
1576  * Returns <0 in case of failure, 0 if false and 1 if true.
1577  */
1578 static int vhost_vdpa_probe_cvq_isolation(int device_fd, uint64_t features,
1579                                           int cvq_index, Error **errp)
1580 {
1581     ERRP_GUARD();
1582     uint64_t backend_features;
1583     int64_t cvq_group;
1584     uint8_t status = VIRTIO_CONFIG_S_ACKNOWLEDGE |
1585                      VIRTIO_CONFIG_S_DRIVER;
1586     int r;
1587 
1588     r = ioctl(device_fd, VHOST_GET_BACKEND_FEATURES, &backend_features);
1589     if (unlikely(r < 0)) {
1590         error_setg_errno(errp, errno, "Cannot get vdpa backend_features");
1591         return r;
1592     }
1593 
1594     if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID))) {
1595         return 0;
1596     }
1597 
1598     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1599     if (unlikely(r)) {
1600         error_setg_errno(errp, -r, "Cannot set device status");
1601         goto out;
1602     }
1603 
1604     r = ioctl(device_fd, VHOST_SET_FEATURES, &features);
1605     if (unlikely(r)) {
1606         error_setg_errno(errp, -r, "Cannot set features");
1607         goto out;
1608     }
1609 
1610     status |= VIRTIO_CONFIG_S_FEATURES_OK;
1611     r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1612     if (unlikely(r)) {
1613         error_setg_errno(errp, -r, "Cannot set device status");
1614         goto out;
1615     }
1616 
1617     cvq_group = vhost_vdpa_get_vring_group(device_fd, cvq_index, errp);
1618     if (unlikely(cvq_group < 0)) {
1619         if (cvq_group != -ENOTSUP) {
1620             r = cvq_group;
1621             goto out;
1622         }
1623 
1624         /*
1625          * The kernel report VHOST_BACKEND_F_IOTLB_ASID if the vdpa frontend
1626          * support ASID even if the parent driver does not.  The CVQ cannot be
1627          * isolated in this case.
1628          */
1629         error_free(*errp);
1630         *errp = NULL;
1631         r = 0;
1632         goto out;
1633     }
1634 
1635     for (int i = 0; i < cvq_index; ++i) {
1636         int64_t group = vhost_vdpa_get_vring_group(device_fd, i, errp);
1637         if (unlikely(group < 0)) {
1638             r = group;
1639             goto out;
1640         }
1641 
1642         if (group == (int64_t)cvq_group) {
1643             r = 0;
1644             goto out;
1645         }
1646     }
1647 
1648     r = 1;
1649 
1650 out:
1651     status = 0;
1652     ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
1653     return r;
1654 }
1655 
1656 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
1657                                        const char *device,
1658                                        const char *name,
1659                                        int vdpa_device_fd,
1660                                        int queue_pair_index,
1661                                        int nvqs,
1662                                        bool is_datapath,
1663                                        bool svq,
1664                                        struct vhost_vdpa_iova_range iova_range,
1665                                        uint64_t features,
1666                                        VhostVDPAShared *shared,
1667                                        Error **errp)
1668 {
1669     NetClientState *nc = NULL;
1670     VhostVDPAState *s;
1671     int ret = 0;
1672     assert(name);
1673     int cvq_isolated = 0;
1674 
1675     if (is_datapath) {
1676         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
1677                                  name);
1678     } else {
1679         cvq_isolated = vhost_vdpa_probe_cvq_isolation(vdpa_device_fd, features,
1680                                                       queue_pair_index * 2,
1681                                                       errp);
1682         if (unlikely(cvq_isolated < 0)) {
1683             return NULL;
1684         }
1685 
1686         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
1687                                          device, name);
1688     }
1689     qemu_set_info_str(nc, TYPE_VHOST_VDPA);
1690     s = DO_UPCAST(VhostVDPAState, nc, nc);
1691 
1692     s->vhost_vdpa.index = queue_pair_index;
1693     s->always_svq = svq;
1694     s->migration_state.notify = NULL;
1695     s->vhost_vdpa.shadow_vqs_enabled = svq;
1696     if (queue_pair_index == 0) {
1697         vhost_vdpa_net_valid_svq_features(features,
1698                                           &s->vhost_vdpa.migration_blocker);
1699         s->vhost_vdpa.shared = g_new0(VhostVDPAShared, 1);
1700         s->vhost_vdpa.shared->device_fd = vdpa_device_fd;
1701         s->vhost_vdpa.shared->iova_range = iova_range;
1702         s->vhost_vdpa.shared->shadow_data = svq;
1703         s->vhost_vdpa.shared->iova_tree = vhost_iova_tree_new(iova_range.first,
1704                                                               iova_range.last);
1705     } else if (!is_datapath) {
1706         s->cvq_cmd_out_buffer = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1707                                      PROT_READ | PROT_WRITE,
1708                                      MAP_SHARED | MAP_ANONYMOUS, -1, 0);
1709         s->status = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
1710                          PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS,
1711                          -1, 0);
1712 
1713         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
1714         s->vhost_vdpa.shadow_vq_ops_opaque = s;
1715         s->cvq_isolated = cvq_isolated;
1716     }
1717     if (queue_pair_index != 0) {
1718         s->vhost_vdpa.shared = shared;
1719     }
1720 
1721     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
1722     if (ret) {
1723         qemu_del_net_client(nc);
1724         return NULL;
1725     }
1726 
1727     return nc;
1728 }
1729 
1730 static int vhost_vdpa_get_features(int fd, uint64_t *features, Error **errp)
1731 {
1732     int ret = ioctl(fd, VHOST_GET_FEATURES, features);
1733     if (unlikely(ret < 0)) {
1734         error_setg_errno(errp, errno,
1735                          "Fail to query features from vhost-vDPA device");
1736     }
1737     return ret;
1738 }
1739 
1740 static int vhost_vdpa_get_max_queue_pairs(int fd, uint64_t features,
1741                                           int *has_cvq, Error **errp)
1742 {
1743     unsigned long config_size = offsetof(struct vhost_vdpa_config, buf);
1744     g_autofree struct vhost_vdpa_config *config = NULL;
1745     __virtio16 *max_queue_pairs;
1746     int ret;
1747 
1748     if (features & (1 << VIRTIO_NET_F_CTRL_VQ)) {
1749         *has_cvq = 1;
1750     } else {
1751         *has_cvq = 0;
1752     }
1753 
1754     if (features & (1 << VIRTIO_NET_F_MQ)) {
1755         config = g_malloc0(config_size + sizeof(*max_queue_pairs));
1756         config->off = offsetof(struct virtio_net_config, max_virtqueue_pairs);
1757         config->len = sizeof(*max_queue_pairs);
1758 
1759         ret = ioctl(fd, VHOST_VDPA_GET_CONFIG, config);
1760         if (ret) {
1761             error_setg(errp, "Fail to get config from vhost-vDPA device");
1762             return -ret;
1763         }
1764 
1765         max_queue_pairs = (__virtio16 *)&config->buf;
1766 
1767         return lduw_le_p(max_queue_pairs);
1768     }
1769 
1770     return 1;
1771 }
1772 
1773 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
1774                         NetClientState *peer, Error **errp)
1775 {
1776     ERRP_GUARD();
1777     const NetdevVhostVDPAOptions *opts;
1778     uint64_t features;
1779     int vdpa_device_fd;
1780     g_autofree NetClientState **ncs = NULL;
1781     struct vhost_vdpa_iova_range iova_range;
1782     NetClientState *nc;
1783     int queue_pairs, r, i = 0, has_cvq = 0;
1784 
1785     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
1786     opts = &netdev->u.vhost_vdpa;
1787     if (!opts->vhostdev && !opts->vhostfd) {
1788         error_setg(errp,
1789                    "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
1790         return -1;
1791     }
1792 
1793     if (opts->vhostdev && opts->vhostfd) {
1794         error_setg(errp,
1795                    "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
1796         return -1;
1797     }
1798 
1799     if (opts->vhostdev) {
1800         vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
1801         if (vdpa_device_fd == -1) {
1802             return -errno;
1803         }
1804     } else {
1805         /* has_vhostfd */
1806         vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
1807         if (vdpa_device_fd == -1) {
1808             error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
1809             return -1;
1810         }
1811     }
1812 
1813     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
1814     if (unlikely(r < 0)) {
1815         goto err;
1816     }
1817 
1818     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
1819                                                  &has_cvq, errp);
1820     if (queue_pairs < 0) {
1821         qemu_close(vdpa_device_fd);
1822         return queue_pairs;
1823     }
1824 
1825     r = vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
1826     if (unlikely(r < 0)) {
1827         error_setg(errp, "vhost-vdpa: get iova range failed: %s",
1828                    strerror(-r));
1829         goto err;
1830     }
1831 
1832     if (opts->x_svq && !vhost_vdpa_net_valid_svq_features(features, errp)) {
1833         goto err;
1834     }
1835 
1836     ncs = g_malloc0(sizeof(*ncs) * queue_pairs);
1837 
1838     for (i = 0; i < queue_pairs; i++) {
1839         VhostVDPAShared *shared = NULL;
1840 
1841         if (i) {
1842             shared = DO_UPCAST(VhostVDPAState, nc, ncs[0])->vhost_vdpa.shared;
1843         }
1844         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1845                                      vdpa_device_fd, i, 2, true, opts->x_svq,
1846                                      iova_range, features, shared, errp);
1847         if (!ncs[i])
1848             goto err;
1849     }
1850 
1851     if (has_cvq) {
1852         VhostVDPAState *s0 = DO_UPCAST(VhostVDPAState, nc, ncs[0]);
1853         VhostVDPAShared *shared = s0->vhost_vdpa.shared;
1854 
1855         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
1856                                  vdpa_device_fd, i, 1, false,
1857                                  opts->x_svq, iova_range, features, shared,
1858                                  errp);
1859         if (!nc)
1860             goto err;
1861     }
1862 
1863     return 0;
1864 
1865 err:
1866     if (i) {
1867         for (i--; i >= 0; i--) {
1868             qemu_del_net_client(ncs[i]);
1869         }
1870     }
1871 
1872     qemu_close(vdpa_device_fd);
1873 
1874     return -1;
1875 }
1876