xref: /openbmc/qemu/net/vhost-vdpa.c (revision ca8717f931463833da3ce5ca9712c9341ba8c308)
1 /*
2  * vhost-vdpa.c
3  *
4  * Copyright(c) 2017-2018 Intel Corporation.
5  * Copyright(c) 2020 Red Hat, Inc.
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or later.
8  * See the COPYING file in the top-level directory.
9  *
10  */
11 
12 #include "qemu/osdep.h"
13 #include "clients.h"
14 #include "hw/virtio/virtio-net.h"
15 #include "net/vhost_net.h"
16 #include "net/vhost-vdpa.h"
17 #include "hw/virtio/vhost-vdpa.h"
18 #include "qemu/config-file.h"
19 #include "qemu/error-report.h"
20 #include "qemu/log.h"
21 #include "qemu/memalign.h"
22 #include "qemu/option.h"
23 #include "qapi/error.h"
24 #include <linux/vhost.h>
25 #include <sys/ioctl.h>
26 #include <err.h>
27 #include "standard-headers/linux/virtio_net.h"
28 #include "monitor/monitor.h"
29 #include "hw/virtio/vhost.h"
30 
31 /* Todo:need to add the multiqueue support here */
32 typedef struct VhostVDPAState {
33     NetClientState nc;
34     struct vhost_vdpa vhost_vdpa;
35     VHostNetState *vhost_net;
36 
37     /* Control commands shadow buffers */
38     void *cvq_cmd_out_buffer;
39     virtio_net_ctrl_ack *status;
40 
41     bool started;
42 } VhostVDPAState;
43 
44 const int vdpa_feature_bits[] = {
45     VIRTIO_F_NOTIFY_ON_EMPTY,
46     VIRTIO_RING_F_INDIRECT_DESC,
47     VIRTIO_RING_F_EVENT_IDX,
48     VIRTIO_F_ANY_LAYOUT,
49     VIRTIO_F_VERSION_1,
50     VIRTIO_NET_F_CSUM,
51     VIRTIO_NET_F_GUEST_CSUM,
52     VIRTIO_NET_F_GSO,
53     VIRTIO_NET_F_GUEST_TSO4,
54     VIRTIO_NET_F_GUEST_TSO6,
55     VIRTIO_NET_F_GUEST_ECN,
56     VIRTIO_NET_F_GUEST_UFO,
57     VIRTIO_NET_F_HOST_TSO4,
58     VIRTIO_NET_F_HOST_TSO6,
59     VIRTIO_NET_F_HOST_ECN,
60     VIRTIO_NET_F_HOST_UFO,
61     VIRTIO_NET_F_MRG_RXBUF,
62     VIRTIO_NET_F_MTU,
63     VIRTIO_NET_F_CTRL_RX,
64     VIRTIO_NET_F_CTRL_RX_EXTRA,
65     VIRTIO_NET_F_CTRL_VLAN,
66     VIRTIO_NET_F_GUEST_ANNOUNCE,
67     VIRTIO_NET_F_CTRL_MAC_ADDR,
68     VIRTIO_NET_F_RSS,
69     VIRTIO_NET_F_MQ,
70     VIRTIO_NET_F_CTRL_VQ,
71     VIRTIO_F_IOMMU_PLATFORM,
72     VIRTIO_F_RING_PACKED,
73     VIRTIO_NET_F_RSS,
74     VIRTIO_NET_F_HASH_REPORT,
75     VIRTIO_NET_F_GUEST_ANNOUNCE,
76     VIRTIO_NET_F_STATUS,
77     VHOST_INVALID_FEATURE_BIT
78 };
79 
80 /** Supported device specific feature bits with SVQ */
81 static const uint64_t vdpa_svq_device_features =
82     BIT_ULL(VIRTIO_NET_F_CSUM) |
83     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
84     BIT_ULL(VIRTIO_NET_F_MTU) |
85     BIT_ULL(VIRTIO_NET_F_MAC) |
86     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |
87     BIT_ULL(VIRTIO_NET_F_GUEST_TSO6) |
88     BIT_ULL(VIRTIO_NET_F_GUEST_ECN) |
89     BIT_ULL(VIRTIO_NET_F_GUEST_UFO) |
90     BIT_ULL(VIRTIO_NET_F_HOST_TSO4) |
91     BIT_ULL(VIRTIO_NET_F_HOST_TSO6) |
92     BIT_ULL(VIRTIO_NET_F_HOST_ECN) |
93     BIT_ULL(VIRTIO_NET_F_HOST_UFO) |
94     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
95     BIT_ULL(VIRTIO_NET_F_STATUS) |
96     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
97     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
98     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |
99     BIT_ULL(VIRTIO_NET_F_RSC_EXT) |
100     BIT_ULL(VIRTIO_NET_F_STANDBY);
101 
102 VHostNetState *vhost_vdpa_get_vhost_net(NetClientState *nc)
103 {
104     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
105     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
106     return s->vhost_net;
107 }
108 
109 static int vhost_vdpa_net_check_device_id(struct vhost_net *net)
110 {
111     uint32_t device_id;
112     int ret;
113     struct vhost_dev *hdev;
114 
115     hdev = (struct vhost_dev *)&net->dev;
116     ret = hdev->vhost_ops->vhost_get_device_id(hdev, &device_id);
117     if (device_id != VIRTIO_ID_NET) {
118         return -ENOTSUP;
119     }
120     return ret;
121 }
122 
123 static int vhost_vdpa_add(NetClientState *ncs, void *be,
124                           int queue_pair_index, int nvqs)
125 {
126     VhostNetOptions options;
127     struct vhost_net *net = NULL;
128     VhostVDPAState *s;
129     int ret;
130 
131     options.backend_type = VHOST_BACKEND_TYPE_VDPA;
132     assert(ncs->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
133     s = DO_UPCAST(VhostVDPAState, nc, ncs);
134     options.net_backend = ncs;
135     options.opaque      = be;
136     options.busyloop_timeout = 0;
137     options.nvqs = nvqs;
138 
139     net = vhost_net_init(&options);
140     if (!net) {
141         error_report("failed to init vhost_net for queue");
142         goto err_init;
143     }
144     s->vhost_net = net;
145     ret = vhost_vdpa_net_check_device_id(net);
146     if (ret) {
147         goto err_check;
148     }
149     return 0;
150 err_check:
151     vhost_net_cleanup(net);
152     g_free(net);
153 err_init:
154     return -1;
155 }
156 
157 static void vhost_vdpa_cleanup(NetClientState *nc)
158 {
159     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
160     struct vhost_dev *dev = &s->vhost_net->dev;
161 
162     qemu_vfree(s->cvq_cmd_out_buffer);
163     qemu_vfree(s->status);
164     if (dev->vq_index + dev->nvqs == dev->vq_index_end) {
165         g_clear_pointer(&s->vhost_vdpa.iova_tree, vhost_iova_tree_delete);
166     }
167     if (s->vhost_net) {
168         vhost_net_cleanup(s->vhost_net);
169         g_free(s->vhost_net);
170         s->vhost_net = NULL;
171     }
172      if (s->vhost_vdpa.device_fd >= 0) {
173         qemu_close(s->vhost_vdpa.device_fd);
174         s->vhost_vdpa.device_fd = -1;
175     }
176 }
177 
178 static bool vhost_vdpa_has_vnet_hdr(NetClientState *nc)
179 {
180     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
181 
182     return true;
183 }
184 
185 static bool vhost_vdpa_has_ufo(NetClientState *nc)
186 {
187     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
188     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
189     uint64_t features = 0;
190     features |= (1ULL << VIRTIO_NET_F_HOST_UFO);
191     features = vhost_net_get_features(s->vhost_net, features);
192     return !!(features & (1ULL << VIRTIO_NET_F_HOST_UFO));
193 
194 }
195 
196 static bool vhost_vdpa_check_peer_type(NetClientState *nc, ObjectClass *oc,
197                                        Error **errp)
198 {
199     const char *driver = object_class_get_name(oc);
200 
201     if (!g_str_has_prefix(driver, "virtio-net-")) {
202         error_setg(errp, "vhost-vdpa requires frontend driver virtio-net-*");
203         return false;
204     }
205 
206     return true;
207 }
208 
209 /** Dummy receive in case qemu falls back to userland tap networking */
210 static ssize_t vhost_vdpa_receive(NetClientState *nc, const uint8_t *buf,
211                                   size_t size)
212 {
213     return 0;
214 }
215 
216 static NetClientInfo net_vhost_vdpa_info = {
217         .type = NET_CLIENT_DRIVER_VHOST_VDPA,
218         .size = sizeof(VhostVDPAState),
219         .receive = vhost_vdpa_receive,
220         .cleanup = vhost_vdpa_cleanup,
221         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
222         .has_ufo = vhost_vdpa_has_ufo,
223         .check_peer_type = vhost_vdpa_check_peer_type,
224 };
225 
226 static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
227 {
228     VhostIOVATree *tree = v->iova_tree;
229     DMAMap needle = {
230         /*
231          * No need to specify size or to look for more translations since
232          * this contiguous chunk was allocated by us.
233          */
234         .translated_addr = (hwaddr)(uintptr_t)addr,
235     };
236     const DMAMap *map = vhost_iova_tree_find_iova(tree, &needle);
237     int r;
238 
239     if (unlikely(!map)) {
240         error_report("Cannot locate expected map");
241         return;
242     }
243 
244     r = vhost_vdpa_dma_unmap(v, map->iova, map->size + 1);
245     if (unlikely(r != 0)) {
246         error_report("Device cannot unmap: %s(%d)", g_strerror(r), r);
247     }
248 
249     vhost_iova_tree_remove(tree, *map);
250 }
251 
252 static size_t vhost_vdpa_net_cvq_cmd_len(void)
253 {
254     /*
255      * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
256      * In buffer is always 1 byte, so it should fit here
257      */
258     return sizeof(struct virtio_net_ctrl_hdr) +
259            2 * sizeof(struct virtio_net_ctrl_mac) +
260            MAC_TABLE_ENTRIES * ETH_ALEN;
261 }
262 
263 static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
264 {
265     return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
266 }
267 
268 /** Map CVQ buffer. */
269 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
270                                   bool write)
271 {
272     DMAMap map = {};
273     int r;
274 
275     map.translated_addr = (hwaddr)(uintptr_t)buf;
276     map.size = size - 1;
277     map.perm = write ? IOMMU_RW : IOMMU_RO,
278     r = vhost_iova_tree_map_alloc(v->iova_tree, &map);
279     if (unlikely(r != IOVA_OK)) {
280         error_report("Cannot map injected element");
281         return r;
282     }
283 
284     r = vhost_vdpa_dma_map(v, map.iova, vhost_vdpa_net_cvq_cmd_page_len(), buf,
285                            !write);
286     if (unlikely(r < 0)) {
287         goto dma_map_err;
288     }
289 
290     return 0;
291 
292 dma_map_err:
293     vhost_iova_tree_remove(v->iova_tree, map);
294     return r;
295 }
296 
297 static int vhost_vdpa_net_cvq_start(NetClientState *nc)
298 {
299     VhostVDPAState *s;
300     int r;
301 
302     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
303 
304     s = DO_UPCAST(VhostVDPAState, nc, nc);
305     if (!s->vhost_vdpa.shadow_vqs_enabled) {
306         return 0;
307     }
308 
309     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer,
310                                vhost_vdpa_net_cvq_cmd_page_len(), false);
311     if (unlikely(r < 0)) {
312         return r;
313     }
314 
315     r = vhost_vdpa_cvq_map_buf(&s->vhost_vdpa, s->status,
316                                vhost_vdpa_net_cvq_cmd_page_len(), true);
317     if (unlikely(r < 0)) {
318         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
319     }
320 
321     return r;
322 }
323 
324 static void vhost_vdpa_net_cvq_stop(NetClientState *nc)
325 {
326     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
327 
328     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
329 
330     if (s->vhost_vdpa.shadow_vqs_enabled) {
331         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->cvq_cmd_out_buffer);
332         vhost_vdpa_cvq_unmap_buf(&s->vhost_vdpa, s->status);
333     }
334 }
335 
336 static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s, size_t out_len,
337                                       size_t in_len)
338 {
339     /* Buffers for the device */
340     const struct iovec out = {
341         .iov_base = s->cvq_cmd_out_buffer,
342         .iov_len = out_len,
343     };
344     const struct iovec in = {
345         .iov_base = s->status,
346         .iov_len = sizeof(virtio_net_ctrl_ack),
347     };
348     VhostShadowVirtqueue *svq = g_ptr_array_index(s->vhost_vdpa.shadow_vqs, 0);
349     int r;
350 
351     r = vhost_svq_add(svq, &out, 1, &in, 1, NULL);
352     if (unlikely(r != 0)) {
353         if (unlikely(r == -ENOSPC)) {
354             qemu_log_mask(LOG_GUEST_ERROR, "%s: No space on device queue\n",
355                           __func__);
356         }
357         return r;
358     }
359 
360     /*
361      * We can poll here since we've had BQL from the time we sent the
362      * descriptor. Also, we need to take the answer before SVQ pulls by itself,
363      * when BQL is released
364      */
365     return vhost_svq_poll(svq);
366 }
367 
368 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s, uint8_t class,
369                                        uint8_t cmd, const void *data,
370                                        size_t data_size)
371 {
372     const struct virtio_net_ctrl_hdr ctrl = {
373         .class = class,
374         .cmd = cmd,
375     };
376 
377     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
378 
379     memcpy(s->cvq_cmd_out_buffer, &ctrl, sizeof(ctrl));
380     memcpy(s->cvq_cmd_out_buffer + sizeof(ctrl), data, data_size);
381 
382     return vhost_vdpa_net_cvq_add(s, sizeof(ctrl) + data_size,
383                                   sizeof(virtio_net_ctrl_ack));
384 }
385 
386 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n)
387 {
388     uint64_t features = n->parent_obj.guest_features;
389     if (features & BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR)) {
390         ssize_t dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MAC,
391                                                   VIRTIO_NET_CTRL_MAC_ADDR_SET,
392                                                   n->mac, sizeof(n->mac));
393         if (unlikely(dev_written < 0)) {
394             return dev_written;
395         }
396 
397         return *s->status != VIRTIO_NET_OK;
398     }
399 
400     return 0;
401 }
402 
403 static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
404                                   const VirtIONet *n)
405 {
406     struct virtio_net_ctrl_mq mq;
407     uint64_t features = n->parent_obj.guest_features;
408     ssize_t dev_written;
409 
410     if (!(features & BIT_ULL(VIRTIO_NET_F_MQ))) {
411         return 0;
412     }
413 
414     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
415     dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MQ,
416                                           VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &mq,
417                                           sizeof(mq));
418     if (unlikely(dev_written < 0)) {
419         return dev_written;
420     }
421 
422     return *s->status != VIRTIO_NET_OK;
423 }
424 
425 static int vhost_vdpa_net_load(NetClientState *nc)
426 {
427     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
428     struct vhost_vdpa *v = &s->vhost_vdpa;
429     const VirtIONet *n;
430     int r;
431 
432     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
433 
434     if (!v->shadow_vqs_enabled) {
435         return 0;
436     }
437 
438     n = VIRTIO_NET(v->dev->vdev);
439     r = vhost_vdpa_net_load_mac(s, n);
440     if (unlikely(r < 0)) {
441         return r;
442     }
443     r = vhost_vdpa_net_load_mq(s, n);
444     if (unlikely(r)) {
445         return r;
446     }
447 
448     return 0;
449 }
450 
451 static NetClientInfo net_vhost_vdpa_cvq_info = {
452     .type = NET_CLIENT_DRIVER_VHOST_VDPA,
453     .size = sizeof(VhostVDPAState),
454     .receive = vhost_vdpa_receive,
455     .start = vhost_vdpa_net_cvq_start,
456     .load = vhost_vdpa_net_load,
457     .stop = vhost_vdpa_net_cvq_stop,
458     .cleanup = vhost_vdpa_cleanup,
459     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
460     .has_ufo = vhost_vdpa_has_ufo,
461     .check_peer_type = vhost_vdpa_check_peer_type,
462 };
463 
464 /**
465  * Do not forward commands not supported by SVQ. Otherwise, the device could
466  * accept it and qemu would not know how to update the device model.
467  */
468 static bool vhost_vdpa_net_cvq_validate_cmd(const void *out_buf, size_t len)
469 {
470     struct virtio_net_ctrl_hdr ctrl;
471 
472     if (unlikely(len < sizeof(ctrl))) {
473         qemu_log_mask(LOG_GUEST_ERROR,
474                       "%s: invalid legnth of out buffer %zu\n", __func__, len);
475         return false;
476     }
477 
478     memcpy(&ctrl, out_buf, sizeof(ctrl));
479     switch (ctrl.class) {
480     case VIRTIO_NET_CTRL_MAC:
481         switch (ctrl.cmd) {
482         case VIRTIO_NET_CTRL_MAC_ADDR_SET:
483             return true;
484         default:
485             qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid mac cmd %u\n",
486                           __func__, ctrl.cmd);
487         };
488         break;
489     case VIRTIO_NET_CTRL_MQ:
490         switch (ctrl.cmd) {
491         case VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET:
492             return true;
493         default:
494             qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid mq cmd %u\n",
495                           __func__, ctrl.cmd);
496         };
497         break;
498     default:
499         qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid control class %u\n",
500                       __func__, ctrl.class);
501     };
502 
503     return false;
504 }
505 
506 /**
507  * Validate and copy control virtqueue commands.
508  *
509  * Following QEMU guidelines, we offer a copy of the buffers to the device to
510  * prevent TOCTOU bugs.
511  */
512 static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
513                                             VirtQueueElement *elem,
514                                             void *opaque)
515 {
516     VhostVDPAState *s = opaque;
517     size_t in_len;
518     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
519     /* Out buffer sent to both the vdpa device and the device model */
520     struct iovec out = {
521         .iov_base = s->cvq_cmd_out_buffer,
522     };
523     /* in buffer used for device model */
524     const struct iovec in = {
525         .iov_base = &status,
526         .iov_len = sizeof(status),
527     };
528     ssize_t dev_written = -EINVAL;
529     bool ok;
530 
531     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
532                              s->cvq_cmd_out_buffer,
533                              vhost_vdpa_net_cvq_cmd_len());
534     ok = vhost_vdpa_net_cvq_validate_cmd(s->cvq_cmd_out_buffer, out.iov_len);
535     if (unlikely(!ok)) {
536         goto out;
537     }
538 
539     dev_written = vhost_vdpa_net_cvq_add(s, out.iov_len, sizeof(status));
540     if (unlikely(dev_written < 0)) {
541         goto out;
542     }
543 
544     if (unlikely(dev_written < sizeof(status))) {
545         error_report("Insufficient written data (%zu)", dev_written);
546         goto out;
547     }
548 
549     if (*s->status != VIRTIO_NET_OK) {
550         return VIRTIO_NET_ERR;
551     }
552 
553     status = VIRTIO_NET_ERR;
554     virtio_net_handle_ctrl_iov(svq->vdev, &in, 1, &out, 1);
555     if (status != VIRTIO_NET_OK) {
556         error_report("Bad CVQ processing in model");
557     }
558 
559 out:
560     in_len = iov_from_buf(elem->in_sg, elem->in_num, 0, &status,
561                           sizeof(status));
562     if (unlikely(in_len < sizeof(status))) {
563         error_report("Bad device CVQ written length");
564     }
565     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
566     g_free(elem);
567     return dev_written < 0 ? dev_written : 0;
568 }
569 
570 static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
571     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
572 };
573 
574 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
575                                            const char *device,
576                                            const char *name,
577                                            int vdpa_device_fd,
578                                            int queue_pair_index,
579                                            int nvqs,
580                                            bool is_datapath,
581                                            bool svq,
582                                            VhostIOVATree *iova_tree)
583 {
584     NetClientState *nc = NULL;
585     VhostVDPAState *s;
586     int ret = 0;
587     assert(name);
588     if (is_datapath) {
589         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
590                                  name);
591     } else {
592         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
593                                          device, name);
594     }
595     snprintf(nc->info_str, sizeof(nc->info_str), TYPE_VHOST_VDPA);
596     s = DO_UPCAST(VhostVDPAState, nc, nc);
597 
598     s->vhost_vdpa.device_fd = vdpa_device_fd;
599     s->vhost_vdpa.index = queue_pair_index;
600     s->vhost_vdpa.shadow_vqs_enabled = svq;
601     s->vhost_vdpa.iova_tree = iova_tree;
602     if (!is_datapath) {
603         s->cvq_cmd_out_buffer = qemu_memalign(qemu_real_host_page_size(),
604                                             vhost_vdpa_net_cvq_cmd_page_len());
605         memset(s->cvq_cmd_out_buffer, 0, vhost_vdpa_net_cvq_cmd_page_len());
606         s->status = qemu_memalign(qemu_real_host_page_size(),
607                                   vhost_vdpa_net_cvq_cmd_page_len());
608         memset(s->status, 0, vhost_vdpa_net_cvq_cmd_page_len());
609 
610         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
611         s->vhost_vdpa.shadow_vq_ops_opaque = s;
612     }
613     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
614     if (ret) {
615         qemu_del_net_client(nc);
616         return NULL;
617     }
618     return nc;
619 }
620 
621 static int vhost_vdpa_get_iova_range(int fd,
622                                      struct vhost_vdpa_iova_range *iova_range)
623 {
624     int ret = ioctl(fd, VHOST_VDPA_GET_IOVA_RANGE, iova_range);
625 
626     return ret < 0 ? -errno : 0;
627 }
628 
629 static int vhost_vdpa_get_features(int fd, uint64_t *features, Error **errp)
630 {
631     int ret = ioctl(fd, VHOST_GET_FEATURES, features);
632     if (unlikely(ret < 0)) {
633         error_setg_errno(errp, errno,
634                          "Fail to query features from vhost-vDPA device");
635     }
636     return ret;
637 }
638 
639 static int vhost_vdpa_get_max_queue_pairs(int fd, uint64_t features,
640                                           int *has_cvq, Error **errp)
641 {
642     unsigned long config_size = offsetof(struct vhost_vdpa_config, buf);
643     g_autofree struct vhost_vdpa_config *config = NULL;
644     __virtio16 *max_queue_pairs;
645     int ret;
646 
647     if (features & (1 << VIRTIO_NET_F_CTRL_VQ)) {
648         *has_cvq = 1;
649     } else {
650         *has_cvq = 0;
651     }
652 
653     if (features & (1 << VIRTIO_NET_F_MQ)) {
654         config = g_malloc0(config_size + sizeof(*max_queue_pairs));
655         config->off = offsetof(struct virtio_net_config, max_virtqueue_pairs);
656         config->len = sizeof(*max_queue_pairs);
657 
658         ret = ioctl(fd, VHOST_VDPA_GET_CONFIG, config);
659         if (ret) {
660             error_setg(errp, "Fail to get config from vhost-vDPA device");
661             return -ret;
662         }
663 
664         max_queue_pairs = (__virtio16 *)&config->buf;
665 
666         return lduw_le_p(max_queue_pairs);
667     }
668 
669     return 1;
670 }
671 
672 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
673                         NetClientState *peer, Error **errp)
674 {
675     const NetdevVhostVDPAOptions *opts;
676     uint64_t features;
677     int vdpa_device_fd;
678     g_autofree NetClientState **ncs = NULL;
679     g_autoptr(VhostIOVATree) iova_tree = NULL;
680     NetClientState *nc;
681     int queue_pairs, r, i = 0, has_cvq = 0;
682 
683     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
684     opts = &netdev->u.vhost_vdpa;
685     if (!opts->vhostdev) {
686         error_setg(errp, "vdpa character device not specified with vhostdev");
687         return -1;
688     }
689 
690     vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
691     if (vdpa_device_fd == -1) {
692         return -errno;
693     }
694 
695     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
696     if (unlikely(r < 0)) {
697         goto err;
698     }
699 
700     queue_pairs = vhost_vdpa_get_max_queue_pairs(vdpa_device_fd, features,
701                                                  &has_cvq, errp);
702     if (queue_pairs < 0) {
703         qemu_close(vdpa_device_fd);
704         return queue_pairs;
705     }
706 
707     if (opts->x_svq) {
708         struct vhost_vdpa_iova_range iova_range;
709 
710         uint64_t invalid_dev_features =
711             features & ~vdpa_svq_device_features &
712             /* Transport are all accepted at this point */
713             ~MAKE_64BIT_MASK(VIRTIO_TRANSPORT_F_START,
714                              VIRTIO_TRANSPORT_F_END - VIRTIO_TRANSPORT_F_START);
715 
716         if (invalid_dev_features) {
717             error_setg(errp, "vdpa svq does not work with features 0x%" PRIx64,
718                        invalid_dev_features);
719             goto err_svq;
720         }
721 
722         vhost_vdpa_get_iova_range(vdpa_device_fd, &iova_range);
723         iova_tree = vhost_iova_tree_new(iova_range.first, iova_range.last);
724     }
725 
726     ncs = g_malloc0(sizeof(*ncs) * queue_pairs);
727 
728     for (i = 0; i < queue_pairs; i++) {
729         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
730                                      vdpa_device_fd, i, 2, true, opts->x_svq,
731                                      iova_tree);
732         if (!ncs[i])
733             goto err;
734     }
735 
736     if (has_cvq) {
737         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
738                                  vdpa_device_fd, i, 1, false,
739                                  opts->x_svq, iova_tree);
740         if (!nc)
741             goto err;
742     }
743 
744     /* iova_tree ownership belongs to last NetClientState */
745     g_steal_pointer(&iova_tree);
746     return 0;
747 
748 err:
749     if (i) {
750         for (i--; i >= 0; i--) {
751             qemu_del_net_client(ncs[i]);
752         }
753     }
754 
755 err_svq:
756     qemu_close(vdpa_device_fd);
757 
758     return -1;
759 }
760