Series comparison

-[PULL 00/26] Net patches
+[PULL V3 00/15] Net patches
-The following changes since commit 344744e148e6e865f5a57e745b02a87e5ea534ad:
+The following changes since commit 352998df1c53b366413690d95b35f76d0721ebed:
-  Merge tag 'dump-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2022-10-26 10:53:49 -0400)
+  Merge tag 'i2c-20220314' of https://github.com/philmd/qemu into staging (2022-03-14 14:39:33 +0000)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to e506fee8b1e092f6ac6f9459bf6a35b807644ad2:
+for you to fetch changes up to 12a195fa343aae2ead1301ce04727bd0ae25eb15:
-  net: stream: add QAPI events to report connection state (2022-10-28 13:28:52 +0800)
+  vdpa: Expose VHOST_F_LOG_ALL on SVQ (2022-03-15 13:57:44 +0800)
 ----------------------------------------------------------------
+Changes since V2:
+- fix 32bit build errros
 ----------------------------------------------------------------
-Daniel P. Berrangé (1):
+Eugenio Pérez (14):
-      net: improve error message for missing netdev backend
+      vhost: Add VhostShadowVirtqueue
       vhost: Add Shadow VirtQueue kick forwarding capabilities
       vhost: Add Shadow VirtQueue call forwarding capabilities
       vhost: Add vhost_svq_valid_features to shadow vq
       virtio: Add vhost_svq_get_vring_addr
       vdpa: adapt vhost_ops callbacks to svq
       vhost: Shadow virtqueue buffers forwarding
       util: Add iova_tree_alloc_map
       util: add iova_tree_find_iova
       vhost: Add VhostIOVATree
       vdpa: Add custom IOTLB translations to SVQ
       vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
       vdpa: Never set log_base addr if SVQ is enabled
       vdpa: Expose VHOST_F_LOG_ALL on SVQ
-Eugenio Pérez (6):
+Jason Wang (1):
-      vdpa: Delete duplicated vdpa_feature_bits entry
+      virtio-net: fix map leaking on error during receive
       vdpa: Remove shadow CVQ command check
       vhost: allocate event_idx fields on vring
       vhost: toggle device callbacks using used event idx
       vhost: use avail event idx on vhost_svq_kick
       vhost: Accept event idx flag
-Laurent Vivier (16):
+ hw/net/virtio-net.c                |   1 +
-      virtio-net: fix bottom-half packet TX on asynchronous completion
+ hw/virtio/meson.build              |   2 +-
-      virtio-net: fix TX timer with tx_burst
+ hw/virtio/vhost-iova-tree.c        | 110 +++++++
-      net: introduce convert_host_port()
+ hw/virtio/vhost-iova-tree.h        |  27 ++
-      net: remove the @errp argument of net_client_inits()
+ hw/virtio/vhost-shadow-virtqueue.c | 636 +++++++++++++++++++++++++++++++++++++
-      net: simplify net_client_parse() error management
+ hw/virtio/vhost-shadow-virtqueue.h |  87 +++++
-      qapi: net: introduce a way to bypass qemu_opts_parse_noisily()
+ hw/virtio/vhost-vdpa.c             | 522 +++++++++++++++++++++++++++++-
-      net: introduce qemu_set_info_str() function
+ include/hw/virtio/vhost-vdpa.h     |   8 +
-      qapi: net: add stream and dgram netdevs
+ include/qemu/iova-tree.h           |  38 ++-
-      net: stream: add unix socket
+ util/iova-tree.c                   | 170 ++++++++++
-      net: dgram: make dgram_dst generic
+files changed, 1584 insertions(+), 17 deletions(-)
-      net: dgram: move mcast specific code from net_socket_fd_init_dgram()
+ create mode 100644 hw/virtio/vhost-iova-tree.c
-      net: dgram: add unix socket
+ create mode 100644 hw/virtio/vhost-iova-tree.h
-      qemu-sockets: move and rename SocketAddress_to_str()
+ create mode 100644 hw/virtio/vhost-shadow-virtqueue.c
-      qemu-sockets: update socket_uri() and socket_parse() to be consistent
+ create mode 100644 hw/virtio/vhost-shadow-virtqueue.h
       net: stream: move to QIO to enable additional parameters
       net: stream: add QAPI events to report connection state
 Si-Wei Liu (1):
       vhost-vdpa: allow passing opened vhostfd to vhost-vdpa
 Stefano Brivio (2):
       net: socket: Don't ignore EINVAL on netdev socket connection
       net: stream: Don't ignore EINVAL on netdev socket connection
  hmp-commands.hx                    |   2 +-
  hw/net/virtio-net.c                |  59 +++-
  hw/net/xen_nic.c                   |   5 +-
  hw/virtio/vhost-shadow-virtqueue.c |  39 ++-
  include/net/net.h                  |   7 +-
  include/qemu/sockets.h             |   4 +-
  monitor/hmp-cmds.c                 |  23 +-
  net/clients.h                      |   6 +
  net/dgram.c                        | 623 +++++++++++++++++++++++++++++++++++++
  net/hub.c                          |   2 +
  net/l2tpv3.c                       |   3 +-
  net/meson.build                    |   2 +
  net/net.c                          | 204 ++++++++----
  net/slirp.c                        |   5 +-
  net/socket.c                       |  36 +--
  net/stream.c                       | 386 +++++++++++++++++++++++
  net/tap-win32.c                    |   3 +-
  net/tap.c                          |  13 +-
  net/vde.c                          |   3 +-
  net/vhost-user.c                   |   3 +-
  net/vhost-vdpa.c                   |  76 ++---
  qapi/net.json                      | 118 ++++++-
  qemu-options.hx                    |  20 +-
  softmmu/vl.c                       |  16 +-
  util/qemu-sockets.c                |  25 ++
 files changed, 1473 insertions(+), 210 deletions(-)
  create mode 100644 net/dgram.c
  create mode 100644 net/stream.c

-[PULL 01/26] virtio-net: fix bottom-half packet TX on asynchronous completion
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-When virtio-net is used with the socket netdev backend, the backend
-can be busy and not able to collect new packets.
-In this case, net_socket_receive() returns 0 and registers a poll function
-to detect when the socket is ready again.
-In virtio_net_tx_bh(), virtio_net_flush_tx() forwards the 0, the virtio
-notifications are disabled and the function is not re-scheduled, waiting
-for the backend to be ready.
-When the socket netdev backend is again able to send packets, the poll
-function re-starts to flush remaining packets. This is done by
-calling virtio_net_tx_complete(). It re-enables notifications and calls
-again virtio_net_flush_tx().
-But it seems if virtio_net_flush_tx() reaches the tx_burst value all
-the queue is not flushed and no new notification is sent to re-schedule
-virtio_net_tx_bh(). Nothing re-start to flush the queue and remaining
-packets are stuck in the queue.
-To fix that, detect in virtio_net_tx_complete() if virtio_net_flush_tx()
-has been stopped by tx_burst and if yes re-schedule the bottom half
-function virtio_net_tx_bh() to flush the remaining packets.
-This is what is done in virtio_net_tx_bh() when the virtio_net_flush_tx()
-is synchronous, and completly by-passed when the operation needs to be
-asynchronous.
-Fixes: a697a334b3c4 ("virtio-net: Introduce a new bottom half packet TX")
-Cc: alex.williamson@redhat.com
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/virtio-net.c | 13 ++++++++++++-
-file changed, 12 insertions(+), 1 deletion(-)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_complete(NetClientState *nc, ssize_t len)
-     VirtIONet *n = qemu_get_nic_opaque(nc);
-     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
-     VirtIODevice *vdev = VIRTIO_DEVICE(n);
-+    int ret;
-     virtqueue_push(q->tx_vq, q->async_tx.elem, 0);
-     virtio_notify(vdev, q->tx_vq);
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_complete(NetClientState *nc, ssize_t len)
-     q->async_tx.elem = NULL;
-     virtio_queue_set_notification(q->tx_vq, 1);
--    virtio_net_flush_tx(q);
-+    ret = virtio_net_flush_tx(q);
-+    if (q->tx_bh && ret >= n->tx_burst) {
-+        /*
-+         * the flush has been stopped by tx_burst
-+         * we will not receive notification for the
-+         * remainining part, so re-schedule
-+         */
-+        virtio_queue_set_notification(q->tx_vq, 0);
-+        qemu_bh_schedule(q->tx_bh);
-+        q->tx_waiting = 1;
-+    }
- }
- /* TX */
---
-.7.4

-[PULL 02/26] virtio-net: fix TX timer with tx_burst
+[PULL V3 01/15] virtio-net: fix map leaking on error during receive
-From: Laurent Vivier <lvivier@redhat.com>
+Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
 tries to fix the use after free of the sg by caching the virtqueue
 elements in an array and unmap them at once after receiving the
 packets, But it forgot to unmap the cached elements on error which
 will lead to leaking of mapping and other unexpected results.
-When virtio_net_flush_tx() reaches the tx_burst value all
+Fixing this by detaching the cached elements on error. This addresses
-the queue is not flushed and nothing restart the timer.
+CVE-2022-26353.
-Fix that by doing for TX timer as we do for bottom half TX:
+Reported-by: Victor Tom <vv474172261@gmail.com>
-rearming the timer if we find any packet to send during the
+Cc: qemu-stable@nongnu.org
-virtio_net_flush_tx() call.
+Fixes: CVE-2022-26353
+Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
 Fixes: e3f30488e5f8 ("virtio-net: Limit number of packets sent per TX flush")
 Cc: alex.williamson@redhat.com
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 50 +++++++++++++++++++++++++++++++++++++++++---------
+ hw/net/virtio-net.c | 1 +
-file changed, 41 insertions(+), 9 deletions(-)
+file changed, 1 insertion(+)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_complete(NetClientState *nc, ssize_t len)
+@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-     virtio_queue_set_notification(q->tx_vq, 1);
+ err:
-     ret = virtio_net_flush_tx(q);
+     for (j = 0; j < i; j++) {
--    if (q->tx_bh && ret >= n->tx_burst) {
++        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
-+    if (ret >= n->tx_burst) {
+         g_free(elems[j]);
          /*
           * the flush has been stopped by tx_burst
           * we will not receive notification for the
           * remainining part, so re-schedule
           */
          virtio_queue_set_notification(q->tx_vq, 0);
 -        qemu_bh_schedule(q->tx_bh);
 +        if (q->tx_bh) {
 +            qemu_bh_schedule(q->tx_bh);
 +        } else {
 +            timer_mod(q->tx_timer,
 +                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
 +        }
          q->tx_waiting = 1;
      }
- }
@@ -XXX,XX +XXX,XX @@ drop:
      return num_packets;
  }
 +static void virtio_net_tx_timer(void *opaque);
 +
  static void virtio_net_handle_tx_timer(VirtIODevice *vdev, VirtQueue *vq)
  {
      VirtIONet *n = VIRTIO_NET(vdev);
@@ -XXX,XX +XXX,XX @@ static void virtio_net_handle_tx_timer(VirtIODevice *vdev, VirtQueue *vq)
      }
      if (q->tx_waiting) {
 -        virtio_queue_set_notification(vq, 1);
 +        /* We already have queued packets, immediately flush */
          timer_del(q->tx_timer);
 -        q->tx_waiting = 0;
 -        if (virtio_net_flush_tx(q) == -EINVAL) {
 -            return;
 -        }
 +        virtio_net_tx_timer(q);
      } else {
 +        /* re-arm timer to flush it (and more) on next tick */
          timer_mod(q->tx_timer,
 -                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
 +                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
          q->tx_waiting = 1;
          virtio_queue_set_notification(vq, 0);
      }
@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_timer(void *opaque)
      VirtIONetQueue *q = opaque;
      VirtIONet *n = q->n;
      VirtIODevice *vdev = VIRTIO_DEVICE(n);
 +    int ret;
 +
      /* This happens when device was stopped but BH wasn't. */
      if (!vdev->vm_running) {
          /* Make sure tx waiting is set, so we'll run when restarted. */
@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_timer(void *opaque)
          return;
      }
 +    ret = virtio_net_flush_tx(q);
 +    if (ret == -EBUSY || ret == -EINVAL) {
 +        return;
 +    }
 +    /*
 +     * If we flush a full burst of packets, assume there are
 +     * more coming and immediately rearm
 +     */
 +    if (ret >= n->tx_burst) {
 +        q->tx_waiting = 1;
 +        timer_mod(q->tx_timer,
 +                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
 +        return;
 +    }
 +    /*
 +     * If less than a full burst, re-enable notification and flush
 +     * anything that may have come in while we weren't looking.  If
 +     * we find something, assume the guest is still active and rearm
 +     */
      virtio_queue_set_notification(q->tx_vq, 1);
 -    virtio_net_flush_tx(q);
 +    ret = virtio_net_flush_tx(q);
 +    if (ret > 0) {
 +        virtio_queue_set_notification(q->tx_vq, 0);
 +        q->tx_waiting = 1;
 +        timer_mod(q->tx_timer,
 +                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
 +    }
  }
  static void virtio_net_tx_bh(void *opaque)
 --
 .7.4

-[PULL 18/26] net: stream: Don't ignore EINVAL on netdev socket connection
+[PULL V3 02/15] vhost: Add VhostShadowVirtqueue
-From: Stefano Brivio <sbrivio@redhat.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-Other errors are treated as failure by net_stream_client_init(),
+Vhost shadow virtqueue (SVQ) is an intermediate jump for virtqueue
-but if connect() returns EINVAL, we'll fail silently. Remove the
+notifications and buffers, allowing qemu to track them. While qemu is
-related exception.
+forwarding the buffers and virtqueue changes, it is able to commit the
 memory it's being dirtied, the same way regular qemu's VirtIO devices
 do.
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+This commit only exposes basic SVQ allocation and free. Next patches of
-[lvivier: applied to net/stream.c]
+the series add functionality like notifications and buffers forwarding.
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/stream.c | 3 +--
+ hw/virtio/meson.build              |  2 +-
-file changed, 1 insertion(+), 2 deletions(-)
+ hw/virtio/vhost-shadow-virtqueue.c | 62 ++++++++++++++++++++++++++++++++++++++
  hw/virtio/vhost-shadow-virtqueue.h | 28 +++++++++++++++++
 files changed, 91 insertions(+), 1 deletion(-)
  create mode 100644 hw/virtio/vhost-shadow-virtqueue.c
  create mode 100644 hw/virtio/vhost-shadow-virtqueue.h
-diff --git a/net/stream.c b/net/stream.c
+diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/net/stream.c
+--- a/hw/virtio/meson.build
-+++ b/net/stream.c
++++ b/hw/virtio/meson.build
-@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ALL', if_true: files('vhost-stub.c'))
-                 if (errno == EINTR || errno == EWOULDBLOCK) {
-                     /* continue */
+ virtio_ss = ss.source_set()
-                 } else if (errno == EINPROGRESS ||
+ virtio_ss.add(files('virtio.c'))
--                           errno == EALREADY ||
+-virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c'))
--                           errno == EINVAL) {
++virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c', 'vhost-shadow-virtqueue.c'))
-+                           errno == EALREADY) {
+ virtio_ss.add(when: 'CONFIG_VHOST_USER', if_true: files('vhost-user.c'))
-                     break;
+ virtio_ss.add(when: 'CONFIG_VHOST_VDPA', if_true: files('vhost-vdpa.c'))
-                 } else {
+ virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-balloon.c'))
-                     error_setg_errno(errp, errno, "can't connect socket");
+diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * vhost shadow virtqueue
 + *
 + * SPDX-FileCopyrightText: Red Hat, Inc. 2021
 + * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/virtio/vhost-shadow-virtqueue.h"
 +
 +#include "qemu/error-report.h"
 +
 +/**
 + * Creates vhost shadow virtqueue, and instructs the vhost device to use the
 + * shadow methods and file descriptors.
 + *
 + * Returns the new virtqueue or NULL.
 + *
 + * In case of error, reason is reported through error_report.
 + */
 +VhostShadowVirtqueue *vhost_svq_new(void)
 +{
 +    g_autofree VhostShadowVirtqueue *svq = g_new0(VhostShadowVirtqueue, 1);
 +    int r;
 +
 +    r = event_notifier_init(&svq->hdev_kick, 0);
 +    if (r != 0) {
 +        error_report("Couldn't create kick event notifier: %s (%d)",
 +                     g_strerror(errno), errno);
 +        goto err_init_hdev_kick;
 +    }
 +
 +    r = event_notifier_init(&svq->hdev_call, 0);
 +    if (r != 0) {
 +        error_report("Couldn't create call event notifier: %s (%d)",
 +                     g_strerror(errno), errno);
 +        goto err_init_hdev_call;
 +    }
 +
 +    return g_steal_pointer(&svq);
 +
 +err_init_hdev_call:
 +    event_notifier_cleanup(&svq->hdev_kick);
 +
 +err_init_hdev_kick:
 +    return NULL;
 +}
 +
 +/**
 + * Free the resources of the shadow virtqueue.
 + *
 + * @pvq: gpointer to SVQ so it can be used by autofree functions.
 + */
 +void vhost_svq_free(gpointer pvq)
 +{
 +    VhostShadowVirtqueue *vq = pvq;
 +    event_notifier_cleanup(&vq->hdev_kick);
 +    event_notifier_cleanup(&vq->hdev_call);
 +    g_free(vq);
 +}
 diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * vhost shadow virtqueue
 + *
 + * SPDX-FileCopyrightText: Red Hat, Inc. 2021
 + * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#ifndef VHOST_SHADOW_VIRTQUEUE_H
 +#define VHOST_SHADOW_VIRTQUEUE_H
 +
 +#include "qemu/event_notifier.h"
 +
 +/* Shadow virtqueue to relay notifications */
 +typedef struct VhostShadowVirtqueue {
 +    /* Shadow kick notifier, sent to vhost */
 +    EventNotifier hdev_kick;
 +    /* Shadow call notifier, sent to vhost */
 +    EventNotifier hdev_call;
 +} VhostShadowVirtqueue;
 +
 +VhostShadowVirtqueue *vhost_svq_new(void);
 +
 +void vhost_svq_free(gpointer vq);
 +G_DEFINE_AUTOPTR_CLEANUP_FUNC(VhostShadowVirtqueue, vhost_svq_free);
 +
 +#endif
 --
 .7.4

-[PULL 10/26] vhost: Accept event idx flag
+[PULL V3 03/15] vhost: Add Shadow VirtQueue kick forwarding capabilities
 From: Eugenio Pérez <eperezma@redhat.com>
-Enabling all the code path created before.
+At this mode no buffer forwarding will be performed in SVQ mode: Qemu
+will just forward the guest's kicks to the device.
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Host memory notifiers regions are left out for simplicity, and they will
 not be addressed in this series.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/virtio/vhost-shadow-virtqueue.c | 1 +
+ hw/virtio/vhost-shadow-virtqueue.c |  55 ++++++++++++++
-file changed, 1 insertion(+)
+ hw/virtio/vhost-shadow-virtqueue.h |  14 ++++
  hw/virtio/vhost-vdpa.c             | 144 ++++++++++++++++++++++++++++++++++++-
  include/hw/virtio/vhost-vdpa.h     |   4 ++
 files changed, 215 insertions(+), 2 deletions(-)
 diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.c
 +++ b/hw/virtio/vhost-shadow-virtqueue.c
-@@ -XXX,XX +XXX,XX @@ bool vhost_svq_valid_features(uint64_t features, Error **errp)
+@@ -XXX,XX +XXX,XX @@
-          ++b) {
+ #include "hw/virtio/vhost-shadow-virtqueue.h"
-         switch (b) {
-         case VIRTIO_F_ANY_LAYOUT:
+ #include "qemu/error-report.h"
-+        case VIRTIO_RING_F_EVENT_IDX:
++#include "qemu/main-loop.h"
-             continue;
++#include "linux-headers/linux/vhost.h"
++
-         case VIRTIO_F_ACCESS_PLATFORM:
++/**
 + * Forward guest notifications.
 + *
 + * @n: guest kick event notifier, the one that guest set to notify svq.
 + */
 +static void vhost_handle_guest_kick(EventNotifier *n)
 +{
 +    VhostShadowVirtqueue *svq = container_of(n, VhostShadowVirtqueue, svq_kick);
 +    event_notifier_test_and_clear(n);
 +    event_notifier_set(&svq->hdev_kick);
 +}
 +
 +/**
 + * Set a new file descriptor for the guest to kick the SVQ and notify for avail
 + *
 + * @svq: The svq
 + * @svq_kick_fd: The svq kick fd
 + *
 + * Note that the SVQ will never close the old file descriptor.
 + */
 +void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd)
 +{
 +    EventNotifier *svq_kick = &svq->svq_kick;
 +    bool poll_stop = VHOST_FILE_UNBIND != event_notifier_get_fd(svq_kick);
 +    bool poll_start = svq_kick_fd != VHOST_FILE_UNBIND;
 +
 +    if (poll_stop) {
 +        event_notifier_set_handler(svq_kick, NULL);
 +    }
 +
 +    /*
 +     * event_notifier_set_handler already checks for guest's notifications if
 +     * they arrive at the new file descriptor in the switch, so there is no
 +     * need to explicitly check for them.
 +     */
 +    if (poll_start) {
 +        event_notifier_init_fd(svq_kick, svq_kick_fd);
 +        event_notifier_set(svq_kick);
 +        event_notifier_set_handler(svq_kick, vhost_handle_guest_kick);
 +    }
 +}
 +
 +/**
 + * Stop the shadow virtqueue operation.
 + * @svq: Shadow Virtqueue
 + */
 +void vhost_svq_stop(VhostShadowVirtqueue *svq)
 +{
 +    event_notifier_set_handler(&svq->svq_kick, NULL);
 +}
  /**
   * Creates vhost shadow virtqueue, and instructs the vhost device to use the
@@ -XXX,XX +XXX,XX @@ VhostShadowVirtqueue *vhost_svq_new(void)
          goto err_init_hdev_call;
      }
 +    event_notifier_init_fd(&svq->svq_kick, VHOST_FILE_UNBIND);
      return g_steal_pointer(&svq);
  err_init_hdev_call:
@@ -XXX,XX +XXX,XX @@ err_init_hdev_kick:
  void vhost_svq_free(gpointer pvq)
  {
      VhostShadowVirtqueue *vq = pvq;
 +    vhost_svq_stop(vq);
      event_notifier_cleanup(&vq->hdev_kick);
      event_notifier_cleanup(&vq->hdev_call);
      g_free(vq);
 diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.h
 +++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
      EventNotifier hdev_kick;
      /* Shadow call notifier, sent to vhost */
      EventNotifier hdev_call;
 +
 +    /*
 +     * Borrowed virtqueue's guest to host notifier. To borrow it in this event
 +     * notifier allows to recover the VhostShadowVirtqueue from the event loop
 +     * easily. If we use the VirtQueue's one, we don't have an easy way to
 +     * retrieve VhostShadowVirtqueue.
 +     *
 +     * So shadow virtqueue must not clean it, or we would lose VirtQueue one.
 +     */
 +    EventNotifier svq_kick;
  } VhostShadowVirtqueue;
 +void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd);
 +
 +void vhost_svq_stop(VhostShadowVirtqueue *svq);
 +
  VhostShadowVirtqueue *vhost_svq_new(void);
  void vhost_svq_free(gpointer vq);
 diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-vdpa.c
 +++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/virtio/vhost.h"
  #include "hw/virtio/vhost-backend.h"
  #include "hw/virtio/virtio-net.h"
 +#include "hw/virtio/vhost-shadow-virtqueue.h"
  #include "hw/virtio/vhost-vdpa.h"
  #include "exec/address-spaces.h"
  #include "qemu/main-loop.h"
  #include "cpu.h"
  #include "trace.h"
  #include "qemu-common.h"
 +#include "qapi/error.h"
  /*
   * Return one past the end of the end of section. Be careful with uint64_t
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_one_time_request(struct vhost_dev *dev)
      return v->index != 0;
  }
 +static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
 +                               Error **errp)
 +{
 +    g_autoptr(GPtrArray) shadow_vqs = NULL;
 +
 +    if (!v->shadow_vqs_enabled) {
 +        return 0;
 +    }
 +
 +    shadow_vqs = g_ptr_array_new_full(hdev->nvqs, vhost_svq_free);
 +    for (unsigned n = 0; n < hdev->nvqs; ++n) {
 +        g_autoptr(VhostShadowVirtqueue) svq = vhost_svq_new();
 +
 +        if (unlikely(!svq)) {
 +            error_setg(errp, "Cannot create svq %u", n);
 +            return -1;
 +        }
 +        g_ptr_array_add(shadow_vqs, g_steal_pointer(&svq));
 +    }
 +
 +    v->shadow_vqs = g_steal_pointer(&shadow_vqs);
 +    return 0;
 +}
 +
  static int vhost_vdpa_init(struct vhost_dev *dev, void *opaque, Error **errp)
  {
      struct vhost_vdpa *v;
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_init(struct vhost_dev *dev, void *opaque, Error **errp)
      dev->opaque =  opaque ;
      v->listener = vhost_vdpa_memory_listener;
      v->msg_type = VHOST_IOTLB_MSG_V2;
 +    ret = vhost_vdpa_init_svq(dev, v, errp);
 +    if (ret) {
 +        goto err;
 +    }
      vhost_vdpa_get_iova_range(v);
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_init(struct vhost_dev *dev, void *opaque, Error **errp)
                                 VIRTIO_CONFIG_S_DRIVER);
      return 0;
 +
 +err:
 +    ram_block_discard_disable(false);
 +    return ret;
  }
  static void vhost_vdpa_host_notifier_uninit(struct vhost_dev *dev,
@@ -XXX,XX +XXX,XX @@ static void vhost_vdpa_host_notifiers_uninit(struct vhost_dev *dev, int n)
  static void vhost_vdpa_host_notifiers_init(struct vhost_dev *dev)
  {
 +    struct vhost_vdpa *v = dev->opaque;
      int i;
 +    if (v->shadow_vqs_enabled) {
 +        /* FIXME SVQ is not compatible with host notifiers mr */
 +        return;
 +    }
 +
      for (i = dev->vq_index; i < dev->vq_index + dev->nvqs; i++) {
          if (vhost_vdpa_host_notifier_init(dev, i)) {
              goto err;
@@ -XXX,XX +XXX,XX @@ err:
      return;
  }
 +static void vhost_vdpa_svq_cleanup(struct vhost_dev *dev)
 +{
 +    struct vhost_vdpa *v = dev->opaque;
 +    size_t idx;
 +
 +    if (!v->shadow_vqs) {
 +        return;
 +    }
 +
 +    for (idx = 0; idx < v->shadow_vqs->len; ++idx) {
 +        vhost_svq_stop(g_ptr_array_index(v->shadow_vqs, idx));
 +    }
 +    g_ptr_array_free(v->shadow_vqs, true);
 +}
 +
  static int vhost_vdpa_cleanup(struct vhost_dev *dev)
  {
      struct vhost_vdpa *v;
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_cleanup(struct vhost_dev *dev)
      trace_vhost_vdpa_cleanup(dev, v);
      vhost_vdpa_host_notifiers_uninit(dev, dev->nvqs);
      memory_listener_unregister(&v->listener);
 +    vhost_vdpa_svq_cleanup(dev);
      dev->opaque = NULL;
      ram_block_discard_disable(false);
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_get_device_id(struct vhost_dev *dev,
      return ret;
  }
 +static void vhost_vdpa_reset_svq(struct vhost_vdpa *v)
 +{
 +    if (!v->shadow_vqs_enabled) {
 +        return;
 +    }
 +
 +    for (unsigned i = 0; i < v->shadow_vqs->len; ++i) {
 +        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, i);
 +        vhost_svq_stop(svq);
 +    }
 +}
 +
  static int vhost_vdpa_reset_device(struct vhost_dev *dev)
  {
 +    struct vhost_vdpa *v = dev->opaque;
      int ret;
      uint8_t status = 0;
 +    vhost_vdpa_reset_svq(v);
 +
      ret = vhost_vdpa_call(dev, VHOST_VDPA_SET_STATUS, &status);
      trace_vhost_vdpa_reset_device(dev, status);
      return ret;
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_get_config(struct vhost_dev *dev, uint8_t *config,
      return ret;
   }
 +static int vhost_vdpa_set_vring_dev_kick(struct vhost_dev *dev,
 +                                         struct vhost_vring_file *file)
 +{
 +    trace_vhost_vdpa_set_vring_kick(dev, file->index, file->fd);
 +    return vhost_vdpa_call(dev, VHOST_SET_VRING_KICK, file);
 +}
 +
 +/**
 + * Set the shadow virtqueue descriptors to the device
 + *
 + * @dev: The vhost device model
 + * @svq: The shadow virtqueue
 + * @idx: The index of the virtqueue in the vhost device
 + * @errp: Error
 + */
 +static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
 +                                 VhostShadowVirtqueue *svq, unsigned idx,
 +                                 Error **errp)
 +{
 +    struct vhost_vring_file file = {
 +        .index = dev->vq_index + idx,
 +    };
 +    const EventNotifier *event_notifier = &svq->hdev_kick;
 +    int r;
 +
 +    file.fd = event_notifier_get_fd(event_notifier);
 +    r = vhost_vdpa_set_vring_dev_kick(dev, &file);
 +    if (unlikely(r != 0)) {
 +        error_setg_errno(errp, -r, "Can't set device kick fd");
 +    }
 +
 +    return r == 0;
 +}
 +
 +static bool vhost_vdpa_svqs_start(struct vhost_dev *dev)
 +{
 +    struct vhost_vdpa *v = dev->opaque;
 +    Error *err = NULL;
 +    unsigned i;
 +
 +    if (!v->shadow_vqs) {
 +        return true;
 +    }
 +
 +    for (i = 0; i < v->shadow_vqs->len; ++i) {
 +        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, i);
 +        bool ok = vhost_vdpa_svq_setup(dev, svq, i, &err);
 +        if (unlikely(!ok)) {
 +            error_reportf_err(err, "Cannot setup SVQ %u: ", i);
 +            return false;
 +        }
 +    }
 +
 +    return true;
 +}
 +
  static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
  {
      struct vhost_vdpa *v = dev->opaque;
 +    bool ok;
      trace_vhost_vdpa_dev_start(dev, started);
      if (started) {
          vhost_vdpa_host_notifiers_init(dev);
 +        ok = vhost_vdpa_svqs_start(dev);
 +        if (unlikely(!ok)) {
 +            return -1;
 +        }
          vhost_vdpa_set_vring_ready(dev);
      } else {
          vhost_vdpa_host_notifiers_uninit(dev, dev->nvqs);
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_get_vring_base(struct vhost_dev *dev,
  static int vhost_vdpa_set_vring_kick(struct vhost_dev *dev,
                                         struct vhost_vring_file *file)
  {
 -    trace_vhost_vdpa_set_vring_kick(dev, file->index, file->fd);
 -    return vhost_vdpa_call(dev, VHOST_SET_VRING_KICK, file);
 +    struct vhost_vdpa *v = dev->opaque;
 +    int vdpa_idx = file->index - dev->vq_index;
 +
 +    if (v->shadow_vqs_enabled) {
 +        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, vdpa_idx);
 +        vhost_svq_set_svq_kick_fd(svq, file->fd);
 +        return 0;
 +    } else {
 +        return vhost_vdpa_set_vring_dev_kick(dev, file);
 +    }
  }
  static int vhost_vdpa_set_vring_call(struct vhost_dev *dev,
 diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/vhost-vdpa.h
 +++ b/include/hw/virtio/vhost-vdpa.h
@@ -XXX,XX +XXX,XX @@
  #ifndef HW_VIRTIO_VHOST_VDPA_H
  #define HW_VIRTIO_VHOST_VDPA_H
 +#include <gmodule.h>
 +
  #include "hw/virtio/virtio.h"
  #include "standard-headers/linux/vhost_types.h"
@@ -XXX,XX +XXX,XX @@ typedef struct vhost_vdpa {
      bool iotlb_batch_begin_sent;
      MemoryListener listener;
      struct vhost_vdpa_iova_range iova_range;
 +    bool shadow_vqs_enabled;
 +    GPtrArray *shadow_vqs;
      struct vhost_dev *dev;
      VhostVDPAHostNotifier notifier[VIRTIO_QUEUE_MAX];
  } VhostVDPA;
 --
 .7.4

-[PULL 08/26] vhost: toggle device callbacks using used event idx
+[PULL V3 04/15] vhost: Add Shadow VirtQueue call forwarding capabilities
 From: Eugenio Pérez <eperezma@redhat.com>
-Actually use the new field of the used ring and tell the device if SVQ
+This will make qemu aware of the device used buffers, allowing it to
-wants to be notified.
+write the guest memory with its contents if needed.
-The code is not reachable at the moment.
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/virtio/vhost-shadow-virtqueue.c | 18 +++++++++++++++---
+ hw/virtio/vhost-shadow-virtqueue.c | 38 ++++++++++++++++++++++++++++++++++++++
-file changed, 15 insertions(+), 3 deletions(-)
+ hw/virtio/vhost-shadow-virtqueue.h |  4 ++++
  hw/virtio/vhost-vdpa.c             | 31 +++++++++++++++++++++++++++++--
 files changed, 71 insertions(+), 2 deletions(-)
 diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.c
 +++ b/hw/virtio/vhost-shadow-virtqueue.c
-@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_more_used(VhostShadowVirtqueue *svq)
+@@ -XXX,XX +XXX,XX @@ static void vhost_handle_guest_kick(EventNotifier *n)
  }
  /**
 + * Forward vhost notifications
 + *
 + * @n: hdev call event notifier, the one that device set to notify svq.
 + */
 +static void vhost_svq_handle_call(EventNotifier *n)
 +{
 +    VhostShadowVirtqueue *svq = container_of(n, VhostShadowVirtqueue,
 +                                             hdev_call);
 +    event_notifier_test_and_clear(n);
 +    event_notifier_set(&svq->svq_call);
 +}
 +
 +/**
 + * Set the call notifier for the SVQ to call the guest
 + *
 + * @svq: Shadow virtqueue
 + * @call_fd: call notifier
 + *
 + * Called on BQL context.
 + */
 +void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd)
 +{
 +    if (call_fd == VHOST_FILE_UNBIND) {
 +        /*
 +         * Fail event_notifier_set if called handling device call.
 +         *
 +         * SVQ still needs device notifications, since it needs to keep
 +         * forwarding used buffers even with the unbind.
 +         */
 +        memset(&svq->svq_call, 0, sizeof(svq->svq_call));
 +    } else {
 +        event_notifier_init_fd(&svq->svq_call, call_fd);
 +    }
 +}
 +
 +/**
   * Set a new file descriptor for the guest to kick the SVQ and notify for avail
   *
   * @svq: The svq
@@ -XXX,XX +XXX,XX @@ VhostShadowVirtqueue *vhost_svq_new(void)
      }
      event_notifier_init_fd(&svq->svq_kick, VHOST_FILE_UNBIND);
 +    event_notifier_set_handler(&svq->hdev_call, vhost_svq_handle_call);
      return g_steal_pointer(&svq);
  err_init_hdev_call:
@@ -XXX,XX +XXX,XX @@ void vhost_svq_free(gpointer pvq)
      VhostShadowVirtqueue *vq = pvq;
      vhost_svq_stop(vq);
      event_notifier_cleanup(&vq->hdev_kick);
 +    event_notifier_set_handler(&vq->hdev_call, NULL);
      event_notifier_cleanup(&vq->hdev_call);
      g_free(vq);
  }
 diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.h
 +++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
       * So shadow virtqueue must not clean it, or we would lose VirtQueue one.
       */
      EventNotifier svq_kick;
 +
 +    /* Guest's call notifier, where the SVQ calls guest. */
 +    EventNotifier svq_call;
  } VhostShadowVirtqueue;
  void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd);
 +void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd);
  void vhost_svq_stop(VhostShadowVirtqueue *svq);
 diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-vdpa.c
 +++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_kick(struct vhost_dev *dev,
      return vhost_vdpa_call(dev, VHOST_SET_VRING_KICK, file);
  }
 +static int vhost_vdpa_set_vring_dev_call(struct vhost_dev *dev,
 +                                         struct vhost_vring_file *file)
 +{
 +    trace_vhost_vdpa_set_vring_call(dev, file->index, file->fd);
 +    return vhost_vdpa_call(dev, VHOST_SET_VRING_CALL, file);
 +}
 +
  /**
   * Set the shadow virtqueue descriptors to the device
   *
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_kick(struct vhost_dev *dev,
   * @svq: The shadow virtqueue
   * @idx: The index of the virtqueue in the vhost device
   * @errp: Error
 + *
 + * Note that this function does not rewind kick file descriptor if cannot set
 + * call one.
   */
- static bool vhost_svq_enable_notification(VhostShadowVirtqueue *svq)
+ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
- {
+                                  VhostShadowVirtqueue *svq, unsigned idx,
--    svq->vring.avail->flags &= ~cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
+@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
--    /* Make sure the flag is written before the read of used_idx */
+     r = vhost_vdpa_set_vring_dev_kick(dev, &file);
-+    if (virtio_vdev_has_feature(svq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
+     if (unlikely(r != 0)) {
-+        uint16_t *used_event = (uint16_t *)&svq->vring.avail->ring[svq->vring.num];
+         error_setg_errno(errp, -r, "Can't set device kick fd");
-+        *used_event = svq->shadow_used_idx;
++        return false;
 +    } else {
 +        svq->vring.avail->flags &= ~cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
 +    }
 +
-+    /* Make sure the event is enabled before the read of used_idx */
++    event_notifier = &svq->hdev_call;
-     smp_mb();
++    file.fd = event_notifier_get_fd(event_notifier);
-     return !vhost_svq_more_used(svq);
++    r = vhost_vdpa_set_vring_dev_call(dev, &file);
- }
++    if (unlikely(r != 0)) {
++        error_setg_errno(errp, -r, "Can't set device call fd");
- static void vhost_svq_disable_notification(VhostShadowVirtqueue *svq)
+     }
      return r == 0;
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_kick(struct vhost_dev *dev,
  static int vhost_vdpa_set_vring_call(struct vhost_dev *dev,
                                         struct vhost_vring_file *file)
  {
--    svq->vring.avail->flags |= cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
+-    trace_vhost_vdpa_set_vring_call(dev, file->index, file->fd);
-+    /*
+-    return vhost_vdpa_call(dev, VHOST_SET_VRING_CALL, file);
-+     * No need to disable notification in the event idx case, since used event
++    struct vhost_vdpa *v = dev->opaque;
-+     * index is already an index too far away.
++
-+     */
++    if (v->shadow_vqs_enabled) {
-+    if (!virtio_vdev_has_feature(svq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
++        int vdpa_idx = file->index - dev->vq_index;
-+        svq->vring.avail->flags |= cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
++        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, vdpa_idx);
 +
 +        vhost_svq_set_svq_call_fd(svq, file->fd);
 +        return 0;
 +    } else {
 +        return vhost_vdpa_set_vring_dev_call(dev, file);
 +    }
  }
- static uint16_t vhost_svq_last_desc_of_chain(const VhostShadowVirtqueue *svq,
+ static int vhost_vdpa_get_features(struct vhost_dev *dev,
 --
 .7.4

-[PULL 09/26] vhost: use avail event idx on vhost_svq_kick
+[PULL V3 05/15] vhost: Add vhost_svq_valid_features to shadow vq
 From: Eugenio Pérez <eperezma@redhat.com>
-So SVQ code knows if an event is needed.
+This allows SVQ to negotiate features with the guest and the device. For
 the device, SVQ is a driver. While this function bypasses all
 non-transport features, it needs to disable the features that SVQ does
 not support when forwarding buffers. This includes packed vq layout,
 indirect descriptors or event idx.
-The code is not reachable at the moment.
+Future changes can add support to offer more features to the guest,
 since the use of VirtQueue gives this for free. This is left out at the
 moment for simplicity.
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/virtio/vhost-shadow-virtqueue.c | 12 +++++++++++-
+ hw/virtio/vhost-shadow-virtqueue.c | 44 ++++++++++++++++++++++++++++++++++++++
-file changed, 11 insertions(+), 1 deletion(-)
+ hw/virtio/vhost-shadow-virtqueue.h |  2 ++
  hw/virtio/vhost-vdpa.c             | 15 +++++++++++++
 files changed, 61 insertions(+)
 diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.c
 +++ b/hw/virtio/vhost-shadow-virtqueue.c
-@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/virtio/vhost-shadow-virtqueue.h"
- static void vhost_svq_kick(VhostShadowVirtqueue *svq)
- {
+ #include "qemu/error-report.h"
-+    bool needs_kick;
++#include "qapi/error.h"
  #include "qemu/main-loop.h"
  #include "linux-headers/linux/vhost.h"
  /**
 + * Validate the transport device features that both guests can use with the SVQ
 + * and SVQs can use with the device.
 + *
 + * @dev_features: The features
 + * @errp: Error pointer
 + */
 +bool vhost_svq_valid_features(uint64_t features, Error **errp)
 +{
 +    bool ok = true;
 +    uint64_t svq_features = features;
 +
-     /*
++    for (uint64_t b = VIRTIO_TRANSPORT_F_START; b <= VIRTIO_TRANSPORT_F_END;
-      * We need to expose the available array entries before checking the used
++         ++b) {
-      * flags
++        switch (b) {
-      */
++        case VIRTIO_F_ANY_LAYOUT:
-     smp_mb();
++            continue;
 -    if (svq->vring.used->flags & VRING_USED_F_NO_NOTIFY) {
 +
-+    if (virtio_vdev_has_feature(svq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
++        case VIRTIO_F_ACCESS_PLATFORM:
-+        uint16_t avail_event = *(uint16_t *)(&svq->vring.used->ring[svq->vring.num]);
++            /* SVQ trust in the host's IOMMU to translate addresses */
-+        needs_kick = vring_need_event(avail_event, svq->shadow_avail_idx, svq->shadow_avail_idx - 1);
++        case VIRTIO_F_VERSION_1:
-+    } else {
++            /* SVQ trust that the guest vring is little endian */
-+        needs_kick = !(svq->vring.used->flags & VRING_USED_F_NO_NOTIFY);
++            if (!(svq_features & BIT_ULL(b))) {
 +                svq_features |= BIT_ULL(b);
 +                ok = false;
 +            }
 +            continue;
 +
 +        default:
 +            if (svq_features & BIT_ULL(b)) {
 +                svq_features &= ~BIT_ULL(b);
 +                ok = false;
 +            }
 +        }
 +    }
 +
-+    if (!needs_kick) {
++    if (!ok) {
-         return;
++        error_setg(errp, "SVQ Invalid device feature flags, offer: 0x%"PRIx64
 +                         ", ok: 0x%"PRIx64, features, svq_features);
 +    }
 +    return ok;
 +}
 +
 +/**
   * Forward guest notifications.
   *
   * @n: guest kick event notifier, the one that guest set to notify svq.
 diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.h
 +++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
      EventNotifier svq_call;
  } VhostShadowVirtqueue;
 +bool vhost_svq_valid_features(uint64_t features, Error **errp);
 +
  void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd);
  void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd);
 diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-vdpa.c
 +++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
                                 Error **errp)
  {
      g_autoptr(GPtrArray) shadow_vqs = NULL;
 +    uint64_t dev_features, svq_features;
 +    int r;
 +    bool ok;
      if (!v->shadow_vqs_enabled) {
          return 0;
      }
++    r = hdev->vhost_ops->vhost_get_features(hdev, &dev_features);
++    if (r != 0) {
++        error_setg_errno(errp, -r, "Can't get vdpa device features");
++        return r;
++    }
++
++    svq_features = dev_features;
++    ok = vhost_svq_valid_features(svq_features, errp);
++    if (unlikely(!ok)) {
++        return -1;
++    }
++
+     shadow_vqs = g_ptr_array_new_full(hdev->nvqs, vhost_svq_free);
+     for (unsigned n = 0; n < hdev->nvqs; ++n) {
+         g_autoptr(VhostShadowVirtqueue) svq = vhost_svq_new();
 --
 .7.4

-[PULL 07/26] vhost: allocate event_idx fields on vring
+[PULL V3 06/15] virtio: Add vhost_svq_get_vring_addr
 From: Eugenio Pérez <eperezma@redhat.com>
-There was not enough room to accomodate them.
+It reports the shadow virtqueue address from qemu virtual address space.
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Since this will be different from the guest's vaddr, but the device can
 access it, SVQ takes special care about its alignment & lack of garbage
 data. It assumes that IOMMU will work in host_page_size ranges for that.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/virtio/vhost-shadow-virtqueue.c | 8 ++++----
+ hw/virtio/vhost-shadow-virtqueue.c | 29 +++++++++++++++++++++++++++++
-file changed, 4 insertions(+), 4 deletions(-)
+ hw/virtio/vhost-shadow-virtqueue.h |  9 +++++++++
 files changed, 38 insertions(+)
 diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.c
 +++ b/hw/virtio/vhost-shadow-virtqueue.c
-@@ -XXX,XX +XXX,XX @@ void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
+@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd)
  size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq)
  {
      size_t desc_size = sizeof(vring_desc_t) * svq->vring.num;
 -    size_t avail_size = offsetof(vring_avail_t, ring) +
 -                                             sizeof(uint16_t) * svq->vring.num;
 +    size_t avail_size = offsetof(vring_avail_t, ring[svq->vring.num]) +
 +                                                              sizeof(uint16_t);
      return ROUND_UP(desc_size + avail_size, qemu_real_host_page_size());
  }
- size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq)
+ /**
- {
++ * Get the shadow vq vring address.
--    size_t used_size = offsetof(vring_used_t, ring) +
++ * @svq: Shadow virtqueue
--                                    sizeof(vring_used_elem_t) * svq->vring.num;
++ * @addr: Destination to store address
-+    size_t used_size = offsetof(vring_used_t, ring[svq->vring.num]) +
++ */
-+                                                              sizeof(uint16_t);
++void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
-     return ROUND_UP(used_size, qemu_real_host_page_size());
++                              struct vhost_vring_addr *addr)
- }
++{
 +    addr->desc_user_addr = (uint64_t)(intptr_t)svq->vring.desc;
 +    addr->avail_user_addr = (uint64_t)(intptr_t)svq->vring.avail;
 +    addr->used_user_addr = (uint64_t)(intptr_t)svq->vring.used;
 +}
 +
 +size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq)
 +{
 +    size_t desc_size = sizeof(vring_desc_t) * svq->vring.num;
 +    size_t avail_size = offsetof(vring_avail_t, ring) +
 +                                             sizeof(uint16_t) * svq->vring.num;
 +
 +    return ROUND_UP(desc_size + avail_size, qemu_real_host_page_size);
 +}
 +
 +size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq)
 +{
 +    size_t used_size = offsetof(vring_used_t, ring) +
 +                                    sizeof(vring_used_elem_t) * svq->vring.num;
 +    return ROUND_UP(used_size, qemu_real_host_page_size);
 +}
 +
 +/**
   * Set a new file descriptor for the guest to kick the SVQ and notify for avail
   *
   * @svq: The svq
 diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.h
 +++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@
  #define VHOST_SHADOW_VIRTQUEUE_H
  #include "qemu/event_notifier.h"
 +#include "hw/virtio/virtio.h"
 +#include "standard-headers/linux/vhost_types.h"
  /* Shadow virtqueue to relay notifications */
  typedef struct VhostShadowVirtqueue {
 +    /* Shadow vring */
 +    struct vring vring;
 +
      /* Shadow kick notifier, sent to vhost */
      EventNotifier hdev_kick;
      /* Shadow call notifier, sent to vhost */
@@ -XXX,XX +XXX,XX @@ bool vhost_svq_valid_features(uint64_t features, Error **errp);
  void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd);
  void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd);
 +void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
 +                              struct vhost_vring_addr *addr);
 +size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq);
 +size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq);
  void vhost_svq_stop(VhostShadowVirtqueue *svq);
 --
 .7.4

-[PULL 15/26] net: introduce qemu_set_info_str() function
+[PULL V3 07/15] vdpa: adapt vhost_ops callbacks to svq
-From: Laurent Vivier <lvivier@redhat.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-Embed the setting of info_str in a function.
+First half of the buffers forwarding part, preparing vhost-vdpa
 callbacks to SVQ to offer it. QEMU cannot enable it at this moment, so
 this is effectively dead code at the moment, but it helps to reduce
 patch size.
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/xen_nic.c  |  5 ++---
+ hw/virtio/vhost-vdpa.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
- include/net/net.h |  1 +
+file changed, 41 insertions(+), 7 deletions(-)
  net/l2tpv3.c      |  3 +--
  net/net.c         | 17 ++++++++++++-----
  net/slirp.c       |  5 ++---
  net/socket.c      | 33 ++++++++++++++-------------------
  net/tap-win32.c   |  3 +--
  net/tap.c         | 13 +++++--------
  net/vde.c         |  3 +--
  net/vhost-user.c  |  3 +--
  net/vhost-vdpa.c  |  2 +-
 files changed, 41 insertions(+), 47 deletions(-)
-diff --git a/hw/net/xen_nic.c b/hw/net/xen_nic.c
+diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/xen_nic.c
+--- a/hw/virtio/vhost-vdpa.c
-+++ b/hw/net/xen_nic.c
++++ b/hw/virtio/vhost-vdpa.c
-@@ -XXX,XX +XXX,XX @@ static int net_init(struct XenLegacyDevice *xendev)
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_get_config(struct vhost_dev *dev, uint8_t *config,
-     netdev->nic = qemu_new_nic(&net_xen_info, &netdev->conf,
+     return ret;
-                                "xen", NULL, netdev);
+  }
--    snprintf(qemu_get_queue(netdev->nic)->info_str,
++static int vhost_vdpa_set_dev_vring_base(struct vhost_dev *dev,
--             sizeof(qemu_get_queue(netdev->nic)->info_str),
++                                         struct vhost_vring_state *ring)
 -             "nic: xenbus vif macaddr=%s", netdev->mac);
 +    qemu_set_info_str(qemu_get_queue(netdev->nic),
 +                      "nic: xenbus vif macaddr=%s", netdev->mac);
      /* fill info */
      xenstore_write_be_int(&netdev->xendev, "feature-rx-copy", 1);
 diff --git a/include/net/net.h b/include/net/net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ ssize_t qemu_send_packet_async(NetClientState *nc, const uint8_t *buf,
  void qemu_purge_queued_packets(NetClientState *nc);
  void qemu_flush_queued_packets(NetClientState *nc);
  void qemu_flush_or_purge_queued_packets(NetClientState *nc, bool purge);
 +void qemu_set_info_str(NetClientState *nc, const char *fmt, ...);
  void qemu_format_nic_info_str(NetClientState *nc, uint8_t macaddr[6]);
  bool qemu_has_ufo(NetClientState *nc);
  bool qemu_has_vnet_hdr(NetClientState *nc);
 diff --git a/net/l2tpv3.c b/net/l2tpv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/l2tpv3.c
 +++ b/net/l2tpv3.c
@@ -XXX,XX +XXX,XX @@ int net_init_l2tpv3(const Netdev *netdev,
      l2tpv3_read_poll(s, true);
 -    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
 -             "l2tpv3: connected");
 +    qemu_set_info_str(&s->nc, "l2tpv3: connected");
      return 0;
  outerr:
      qemu_del_net_client(nc);
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ char *qemu_mac_strdup_printf(const uint8_t *macaddr)
                             macaddr[3], macaddr[4], macaddr[5]);
  }
 +void qemu_set_info_str(NetClientState *nc, const char *fmt, ...)
 +{
-+    va_list ap;
++    trace_vhost_vdpa_set_vring_base(dev, ring->index, ring->num);
-+
++    return vhost_vdpa_call(dev, VHOST_SET_VRING_BASE, ring);
 +    va_start(ap, fmt);
 +    vsnprintf(nc->info_str, sizeof(nc->info_str), fmt, ap);
 +    va_end(ap);
 +}
 +
- void qemu_format_nic_info_str(NetClientState *nc, uint8_t macaddr[6])
+ static int vhost_vdpa_set_vring_dev_kick(struct vhost_dev *dev,
                                           struct vhost_vring_file *file)
  {
--    snprintf(nc->info_str, sizeof(nc->info_str),
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_call(struct vhost_dev *dev,
--             "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
+     return vhost_vdpa_call(dev, VHOST_SET_VRING_CALL, file);
 -             nc->model,
 -             macaddr[0], macaddr[1], macaddr[2],
 -             macaddr[3], macaddr[4], macaddr[5]);
 +    qemu_set_info_str(nc, "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 +                      nc->model, macaddr[0], macaddr[1], macaddr[2],
 +                      macaddr[3], macaddr[4], macaddr[5]);
  }
- static int mac_table[256] = {0};
++static int vhost_vdpa_set_vring_dev_addr(struct vhost_dev *dev,
-diff --git a/net/slirp.c b/net/slirp.c
++                                         struct vhost_vring_addr *addr)
-index XXXXXXX..XXXXXXX 100644
++{
---- a/net/slirp.c
++    trace_vhost_vdpa_set_vring_addr(dev, addr->index, addr->flags,
-+++ b/net/slirp.c
++                                addr->desc_user_addr, addr->used_user_addr,
-@@ -XXX,XX +XXX,XX @@ static int net_slirp_init(NetClientState *peer, const char *model,
++                                addr->avail_user_addr,
++                                addr->log_guest_addr);
-     nc = qemu_new_net_client(&net_slirp_info, peer, model, name);
++
++    return vhost_vdpa_call(dev, VHOST_SET_VRING_ADDR, addr);
--    snprintf(nc->info_str, sizeof(nc->info_str),
++
--             "net=%s,restrict=%s", inet_ntoa(net),
++}
--             restricted ? "on" : "off");
++
-+    qemu_set_info_str(nc, "net=%s,restrict=%s", inet_ntoa(net),
+ /**
-+                      restricted ? "on" : "off");
+  * Set the shadow virtqueue descriptors to the device
+  *
-     s = DO_UPCAST(SlirpState, nc, nc);
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_log_base(struct vhost_dev *dev, uint64_t base,
+ static int vhost_vdpa_set_vring_addr(struct vhost_dev *dev,
-diff --git a/net/socket.c b/net/socket.c
+                                        struct vhost_vring_addr *addr)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/net/socket.c
+-    trace_vhost_vdpa_set_vring_addr(dev, addr->index, addr->flags,
-+++ b/net/socket.c
+-                                    addr->desc_user_addr, addr->used_user_addr,
-@@ -XXX,XX +XXX,XX @@ static void net_socket_send(void *opaque)
+-                                    addr->avail_user_addr,
-         s->fd = -1;
+-                                    addr->log_guest_addr);
-         net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
+-    return vhost_vdpa_call(dev, VHOST_SET_VRING_ADDR, addr);
-         s->nc.link_down = true;
++    struct vhost_vdpa *v = dev->opaque;
--        memset(s->nc.info_str, 0, sizeof(s->nc.info_str));
++
-+        qemu_set_info_str(&s->nc, "");
++    if (v->shadow_vqs_enabled) {
++        /*
-         return;
++         * Device vring addr was set at device start. SVQ base is handled by
-     }
++         * VirtQueue code.
-@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_dgram(NetClientState *peer,
++         */
-     /* mcast: save bound address as dst */
++        return 0;
-     if (is_connected && mcast != NULL) {
++    }
-         s->dgram_dst = saddr;
++
--        snprintf(nc->info_str, sizeof(nc->info_str),
++    return vhost_vdpa_set_vring_dev_addr(dev, addr);
 -                 "socket: fd=%d (cloned mcast=%s:%d)",
 -                 fd, inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 +        qemu_set_info_str(nc, "socket: fd=%d (cloned mcast=%s:%d)", fd,
 +                          inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
      } else {
          if (sa_type == SOCKET_ADDRESS_TYPE_UNIX) {
              s->dgram_dst.sin_family = AF_UNIX;
          }
 -        snprintf(nc->info_str, sizeof(nc->info_str),
 -                 "socket: fd=%d %s", fd, SocketAddressType_str(sa_type));
 +        qemu_set_info_str(nc, "socket: fd=%d %s", fd,
 +                          SocketAddressType_str(sa_type));
      }
      return s;
@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_stream(NetClientState *peer,
      nc = qemu_new_net_client(&net_socket_info, peer, model, name);
 -    snprintf(nc->info_str, sizeof(nc->info_str), "socket: fd=%d", fd);
 +    qemu_set_info_str(nc, "socket: fd=%d", fd);
      s = DO_UPCAST(NetSocketState, nc, nc);
@@ -XXX,XX +XXX,XX @@ static void net_socket_accept(void *opaque)
      s->fd = fd;
      s->nc.link_down = false;
      net_socket_connect(s);
 -    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
 -             "socket: connection from %s:%d",
 -             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 +    qemu_set_info_str(&s->nc, "socket: connection from %s:%d",
 +                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
  }
- static int net_socket_listen_init(NetClientState *peer,
+ static int vhost_vdpa_set_vring_num(struct vhost_dev *dev,
-@@ -XXX,XX +XXX,XX @@ static int net_socket_connect_init(NetClientState *peer,
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_num(struct vhost_dev *dev,
-         return -1;
+ static int vhost_vdpa_set_vring_base(struct vhost_dev *dev,
-     }
+                                        struct vhost_vring_state *ring)
+ {
--    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
+-    trace_vhost_vdpa_set_vring_base(dev, ring->index, ring->num);
--             "socket: connect to %s:%d",
+-    return vhost_vdpa_call(dev, VHOST_SET_VRING_BASE, ring);
--             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
++    struct vhost_vdpa *v = dev->opaque;
-+    qemu_set_info_str(&s->nc, "socket: connect to %s:%d",
++
-+                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
++    if (v->shadow_vqs_enabled) {
-     return 0;
++        /*
 +         * Device vring base was set at device start. SVQ base is handled by
 +         * VirtQueue code.
 +         */
 +        return 0;
 +    }
 +
 +    return vhost_vdpa_set_dev_vring_base(dev, ring);
  }
-@@ -XXX,XX +XXX,XX @@ static int net_socket_mcast_init(NetClientState *peer,
+ static int vhost_vdpa_get_vring_base(struct vhost_dev *dev,
      s->dgram_dst = saddr;
 -    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
 -             "socket: mcast=%s:%d",
 -             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 +    qemu_set_info_str(&s->nc, "socket: mcast=%s:%d",
 +                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static int net_socket_udp_init(NetClientState *peer,
      s->dgram_dst = raddr;
 -    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
 -             "socket: udp=%s:%d",
 -             inet_ntoa(raddr.sin_addr), ntohs(raddr.sin_port));
 +    qemu_set_info_str(&s->nc, "socket: udp=%s:%d", inet_ntoa(raddr.sin_addr),
 +                      ntohs(raddr.sin_port));
      return 0;
  }
 diff --git a/net/tap-win32.c b/net/tap-win32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap-win32.c
 +++ b/net/tap-win32.c
@@ -XXX,XX +XXX,XX @@ static int tap_win32_init(NetClientState *peer, const char *model,
      s = DO_UPCAST(TAPState, nc, nc);
 -    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
 -             "tap: ifname=%s", ifname);
 +    qemu_set_info_str(&s->nc, "tap: ifname=%s", ifname);
      s->handle = handle;
 diff --git a/net/tap.c b/net/tap.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap.c
 +++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ int net_init_bridge(const Netdev *netdev, const char *name,
      }
      s = net_tap_fd_init(peer, "bridge", name, fd, vnet_hdr);
 -    snprintf(s->nc.info_str, sizeof(s->nc.info_str), "helper=%s,br=%s", helper,
 -             br);
 +    qemu_set_info_str(&s->nc, "helper=%s,br=%s", helper, br);
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
      }
      if (tap->has_fd || tap->has_fds) {
 -        snprintf(s->nc.info_str, sizeof(s->nc.info_str), "fd=%d", fd);
 +        qemu_set_info_str(&s->nc, "fd=%d", fd);
      } else if (tap->has_helper) {
 -        snprintf(s->nc.info_str, sizeof(s->nc.info_str), "helper=%s",
 -                 tap->helper);
 +        qemu_set_info_str(&s->nc, "helper=%s", tap->helper);
      } else {
 -        snprintf(s->nc.info_str, sizeof(s->nc.info_str),
 -                 "ifname=%s,script=%s,downscript=%s", ifname, script,
 -                 downscript);
 +        qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname,
 +                          script, downscript);
          if (strcmp(downscript, "no") != 0) {
              snprintf(s->down_script, sizeof(s->down_script), "%s", downscript);
 diff --git a/net/vde.c b/net/vde.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vde.c
 +++ b/net/vde.c
@@ -XXX,XX +XXX,XX @@ static int net_vde_init(NetClientState *peer, const char *model,
      nc = qemu_new_net_client(&net_vde_info, peer, model, name);
 -    snprintf(nc->info_str, sizeof(nc->info_str), "sock=%s,fd=%d",
 -             sock, vde_datafd(vde));
 +    qemu_set_info_str(nc, "sock=%s,fd=%d", sock, vde_datafd(vde));
      s = DO_UPCAST(VDEState, nc, nc);
 diff --git a/net/vhost-user.c b/net/vhost-user.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vhost-user.c
 +++ b/net/vhost-user.c
@@ -XXX,XX +XXX,XX @@ static int net_vhost_user_init(NetClientState *peer, const char *device,
      user = g_new0(struct VhostUserState, 1);
      for (i = 0; i < queues; i++) {
          nc = qemu_new_net_client(&net_vhost_user_info, peer, device, name);
 -        snprintf(nc->info_str, sizeof(nc->info_str), "vhost-user%d to %s",
 -                 i, chr->label);
 +        qemu_set_info_str(nc, "vhost-user%d to %s", i, chr->label);
          nc->queue_index = i;
          if (!nc0) {
              nc0 = nc;
 diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vhost-vdpa.c
 +++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
          nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
                                           device, name);
      }
 -    snprintf(nc->info_str, sizeof(nc->info_str), TYPE_VHOST_VDPA);
 +    qemu_set_info_str(nc, TYPE_VHOST_VDPA);
      s = DO_UPCAST(VhostVDPAState, nc, nc);
      s->vhost_vdpa.device_fd = vdpa_device_fd;
 --
 .7.4

-[PULL 25/26] net: stream: move to QIO to enable additional parameters
+[PULL V3 08/15] vhost: Shadow virtqueue buffers forwarding
-From: Laurent Vivier <lvivier@redhat.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-Use QIOChannel, QIOChannelSocket and QIONetListener.
+Initial version of shadow virtqueue that actually forward buffers. There
-This allows net/stream to use all the available parameters provided by
+is no iommu support at the moment, and that will be addressed in future
-SocketAddress.
+patches of this series. Since all vhost-vdpa devices use forced IOMMU,
+this means that SVQ is not usable at this point of the series on any
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+device.
 For simplicity it only supports modern devices, that expects vring
 in little endian, with split ring and no event idx or indirect
 descriptors. Support for them will not be added in this series.
 It reuses the VirtQueue code for the device part. The driver part is
 based on Linux's virtio_ring driver, but with stripped functionality
 and optimizations so it's easier to review.
 However, forwarding buffers have some particular pieces: One of the most
 unexpected ones is that a guest's buffer can expand through more than
 one descriptor in SVQ. While this is handled gracefully by qemu's
 emulated virtio devices, it may cause unexpected SVQ queue full. This
 patch also solves it by checking for this condition at both guest's
 kicks and device's calls. The code may be more elegant in the future if
 SVQ code runs in its own iocontext.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/stream.c    | 492 ++++++++++++++++++++------------------------------------
+ hw/virtio/vhost-shadow-virtqueue.c | 352 ++++++++++++++++++++++++++++++++++++-
- qemu-options.hx |   4 +-
+ hw/virtio/vhost-shadow-virtqueue.h |  26 +++
-files changed, 178 insertions(+), 318 deletions(-)
+ hw/virtio/vhost-vdpa.c             | 155 +++++++++++++++-
+files changed, 522 insertions(+), 11 deletions(-)
-diff --git a/net/stream.c b/net/stream.c
 diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/stream.c
+--- a/hw/virtio/vhost-shadow-virtqueue.c
-+++ b/net/stream.c
++++ b/hw/virtio/vhost-shadow-virtqueue.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/iov.h"
+ #include "qemu/error-report.h"
  #include "qapi/error.h"
  #include "qemu/main-loop.h"
- #include "qemu/cutils.h"
++#include "qemu/log.h"
-+#include "io/channel.h"
++#include "qemu/memalign.h"
-+#include "io/channel-socket.h"
+ #include "linux-headers/linux/vhost.h"
-+#include "io/net-listener.h"
+ /**
- typedef struct NetStreamState {
+@@ -XXX,XX +XXX,XX @@ bool vhost_svq_valid_features(uint64_t features, Error **errp)
-     NetClientState nc;
+ }
--    int listen_fd;
--    int fd;
+ /**
-+    QIOChannel *listen_ioc;
+- * Forward guest notifications.
-+    QIONetListener *listener;
++ * Number of descriptors that the SVQ can make available from the guest.
-+    QIOChannel *ioc;
++ *
-+    guint ioc_read_tag;
++ * @svq: The svq
-+    guint ioc_write_tag;
++ */
-     SocketReadState rs;
++static uint16_t vhost_svq_available_slots(const VhostShadowVirtqueue *svq)
-     unsigned int send_index;      /* number of bytes sent*/
++{
--    bool read_poll;               /* waiting to receive data? */
++    return svq->vring.num - (svq->shadow_avail_idx - svq->shadow_used_idx);
--    bool write_poll;              /* waiting to transmit data? */
++}
- } NetStreamState;
++
++static void vhost_vring_write_descs(VhostShadowVirtqueue *svq,
--static void net_stream_send(void *opaque);
++                                    const struct iovec *iovec, size_t num,
--static void net_stream_accept(void *opaque);
++                                    bool more_descs, bool write)
--static void net_stream_writable(void *opaque);
++{
-+static void net_stream_listen(QIONetListener *listener,
++    uint16_t i = svq->free_head, last = svq->free_head;
-+                              QIOChannelSocket *cioc,
++    unsigned n;
-+                              void *opaque);
++    uint16_t flags = write ? cpu_to_le16(VRING_DESC_F_WRITE) : 0;
++    vring_desc_t *descs = svq->vring.desc;
--static void net_stream_update_fd_handler(NetStreamState *s)
++
-+static gboolean net_stream_writable(QIOChannel *ioc,
++    if (num == 0) {
-+                                    GIOCondition condition,
++        return;
-+                                    gpointer data)
++    }
 +
 +    for (n = 0; n < num; n++) {
 +        if (more_descs || (n + 1 < num)) {
 +            descs[i].flags = flags | cpu_to_le16(VRING_DESC_F_NEXT);
 +        } else {
 +            descs[i].flags = flags;
 +        }
 +        descs[i].addr = cpu_to_le64((hwaddr)(intptr_t)iovec[n].iov_base);
 +        descs[i].len = cpu_to_le32(iovec[n].iov_len);
 +
 +        last = i;
 +        i = cpu_to_le16(descs[i].next);
 +    }
 +
 +    svq->free_head = le16_to_cpu(descs[last].next);
 +}
 +
 +static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
 +                                VirtQueueElement *elem, unsigned *head)
 +{
 +    unsigned avail_idx;
 +    vring_avail_t *avail = svq->vring.avail;
 +
 +    *head = svq->free_head;
 +
 +    /* We need some descriptors here */
 +    if (unlikely(!elem->out_num && !elem->in_num)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "Guest provided element with no descriptors");
 +        return false;
 +    }
 +
 +    vhost_vring_write_descs(svq, elem->out_sg, elem->out_num, elem->in_num > 0,
 +                            false);
 +    vhost_vring_write_descs(svq, elem->in_sg, elem->in_num, false, true);
 +
 +    /*
 +     * Put the entry in the available array (but don't update avail->idx until
 +     * they do sync).
 +     */
 +    avail_idx = svq->shadow_avail_idx & (svq->vring.num - 1);
 +    avail->ring[avail_idx] = cpu_to_le16(*head);
 +    svq->shadow_avail_idx++;
 +
 +    /* Update the avail index after write the descriptor */
 +    smp_wmb();
 +    avail->idx = cpu_to_le16(svq->shadow_avail_idx);
 +
 +    return true;
 +}
 +
 +static bool vhost_svq_add(VhostShadowVirtqueue *svq, VirtQueueElement *elem)
 +{
 +    unsigned qemu_head;
 +    bool ok = vhost_svq_add_split(svq, elem, &qemu_head);
 +    if (unlikely(!ok)) {
 +        return false;
 +    }
 +
 +    svq->ring_id_maps[qemu_head] = elem;
 +    return true;
 +}
 +
 +static void vhost_svq_kick(VhostShadowVirtqueue *svq)
 +{
 +    /*
 +     * We need to expose the available array entries before checking the used
 +     * flags
 +     */
 +    smp_mb();
 +    if (svq->vring.used->flags & VRING_USED_F_NO_NOTIFY) {
 +        return;
 +    }
 +
 +    event_notifier_set(&svq->hdev_kick);
 +}
 +
 +/**
 + * Forward available buffers.
 + *
 + * @svq: Shadow VirtQueue
 + *
 + * Note that this function does not guarantee that all guest's available
 + * buffers are available to the device in SVQ avail ring. The guest may have
 + * exposed a GPA / GIOVA contiguous buffer, but it may not be contiguous in
 + * qemu vaddr.
 + *
 + * If that happens, guest's kick notifications will be disabled until the
 + * device uses some buffers.
 + */
 +static void vhost_handle_guest_kick(VhostShadowVirtqueue *svq)
 +{
 +    /* Clear event notifier */
 +    event_notifier_test_and_clear(&svq->svq_kick);
 +
 +    /* Forward to the device as many available buffers as possible */
 +    do {
 +        virtio_queue_set_notification(svq->vq, false);
 +
 +        while (true) {
 +            VirtQueueElement *elem;
 +            bool ok;
 +
 +            if (svq->next_guest_avail_elem) {
 +                elem = g_steal_pointer(&svq->next_guest_avail_elem);
 +            } else {
 +                elem = virtqueue_pop(svq->vq, sizeof(*elem));
 +            }
 +
 +            if (!elem) {
 +                break;
 +            }
 +
 +            if (elem->out_num + elem->in_num > vhost_svq_available_slots(svq)) {
 +                /*
 +                 * This condition is possible since a contiguous buffer in GPA
 +                 * does not imply a contiguous buffer in qemu's VA
 +                 * scatter-gather segments. If that happens, the buffer exposed
 +                 * to the device needs to be a chain of descriptors at this
 +                 * moment.
 +                 *
 +                 * SVQ cannot hold more available buffers if we are here:
 +                 * queue the current guest descriptor and ignore further kicks
 +                 * until some elements are used.
 +                 */
 +                svq->next_guest_avail_elem = elem;
 +                return;
 +            }
 +
 +            ok = vhost_svq_add(svq, elem);
 +            if (unlikely(!ok)) {
 +                /* VQ is broken, just return and ignore any other kicks */
 +                return;
 +            }
 +            vhost_svq_kick(svq);
 +        }
 +
 +        virtio_queue_set_notification(svq->vq, true);
 +    } while (!virtio_queue_empty(svq->vq));
 +}
 +
 +/**
 + * Handle guest's kick.
   *
   * @n: guest kick event notifier, the one that guest set to notify svq.
   */
 -static void vhost_handle_guest_kick(EventNotifier *n)
 +static void vhost_handle_guest_kick_notifier(EventNotifier *n)
  {
--    qemu_set_fd_handler(s->fd,
+     VhostShadowVirtqueue *svq = container_of(n, VhostShadowVirtqueue, svq_kick);
--                        s->read_poll ? net_stream_send : NULL,
+     event_notifier_test_and_clear(n);
--                        s->write_poll ? net_stream_writable : NULL,
+-    event_notifier_set(&svq->hdev_kick);
--                        s);
++    vhost_handle_guest_kick(svq);
--}
++}
--
++
--static void net_stream_read_poll(NetStreamState *s, bool enable)
++static bool vhost_svq_more_used(VhostShadowVirtqueue *svq)
--{
++{
--    s->read_poll = enable;
++    if (svq->last_used_idx != svq->shadow_used_idx) {
--    net_stream_update_fd_handler(s);
++        return true;
--}
++    }
--
++
--static void net_stream_write_poll(NetStreamState *s, bool enable)
++    svq->shadow_used_idx = cpu_to_le16(svq->vring.used->idx);
--{
++
--    s->write_poll = enable;
++    return svq->last_used_idx != svq->shadow_used_idx;
 -    net_stream_update_fd_handler(s);
 -}
 -
 -static void net_stream_writable(void *opaque)
 -{
 -    NetStreamState *s = opaque;
 +    NetStreamState *s = data;
 -    net_stream_write_poll(s, false);
 +    s->ioc_write_tag = 0;
      qemu_flush_queued_packets(&s->nc);
 +
 +    return G_SOURCE_REMOVE;
  }
- static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
+ /**
-@@ -XXX,XX +XXX,XX @@ static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
+- * Forward vhost notifications
-             .iov_len  = size,
++ * Enable vhost device calls after disable them.
-         },
++ *
-     };
++ * @svq: The svq
-+    struct iovec local_iov[2];
++ *
-+    unsigned int nlocal_iov;
++ * It returns false if there are pending used buffers from the vhost device,
-     size_t remaining;
++ * avoiding the possible races between SVQ checking for more work and enabling
-     ssize_t ret;
++ * callbacks. True if SVQ used vring has no more pending buffers.
++ */
-     remaining = iov_size(iov, 2) - s->send_index;
++static bool vhost_svq_enable_notification(VhostShadowVirtqueue *svq)
--    ret = iov_send(s->fd, iov, 2, s->send_index, remaining);
++{
--
++    svq->vring.avail->flags &= ~cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
--    if (ret == -1 && errno == EAGAIN) {
++    /* Make sure the flag is written before the read of used_idx */
-+    nlocal_iov = iov_copy(local_iov, 2, iov, 2, s->send_index, remaining);
++    smp_mb();
-+    ret = qio_channel_writev(s->ioc, local_iov, nlocal_iov, NULL);
++    return !vhost_svq_more_used(svq);
-+    if (ret == QIO_CHANNEL_ERR_BLOCK) {
++}
-         ret = 0; /* handled further down */
++
-     }
++static void vhost_svq_disable_notification(VhostShadowVirtqueue *svq)
-     if (ret == -1) {
++{
-@@ -XXX,XX +XXX,XX @@ static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
++    svq->vring.avail->flags |= cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
-     }
++}
-     if (ret < (ssize_t)remaining) {
++
-         s->send_index += ret;
++static VirtQueueElement *vhost_svq_get_buf(VhostShadowVirtqueue *svq,
--        net_stream_write_poll(s, true);
++                                           uint32_t *len)
-+        s->ioc_write_tag = qio_channel_add_watch(s->ioc, G_IO_OUT,
++{
-+                                                 net_stream_writable, s, NULL);
++    vring_desc_t *descs = svq->vring.desc;
-         return 0;
++    const vring_used_t *used = svq->vring.used;
-     }
++    vring_used_elem_t used_elem;
-     s->send_index = 0;
++    uint16_t last_used;
-     return size;
++
 +    if (!vhost_svq_more_used(svq)) {
 +        return NULL;
 +    }
 +
 +    /* Only get used array entries after they have been exposed by dev */
 +    smp_rmb();
 +    last_used = svq->last_used_idx & (svq->vring.num - 1);
 +    used_elem.id = le32_to_cpu(used->ring[last_used].id);
 +    used_elem.len = le32_to_cpu(used->ring[last_used].len);
 +
 +    svq->last_used_idx++;
 +    if (unlikely(used_elem.id >= svq->vring.num)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "Device %s says index %u is used",
 +                      svq->vdev->name, used_elem.id);
 +        return NULL;
 +    }
 +
 +    if (unlikely(!svq->ring_id_maps[used_elem.id])) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +            "Device %s says index %u is used, but it was not available",
 +            svq->vdev->name, used_elem.id);
 +        return NULL;
 +    }
 +
 +    descs[used_elem.id].next = svq->free_head;
 +    svq->free_head = used_elem.id;
 +
 +    *len = used_elem.len;
 +    return g_steal_pointer(&svq->ring_id_maps[used_elem.id]);
 +}
 +
 +static void vhost_svq_flush(VhostShadowVirtqueue *svq,
 +                            bool check_for_avail_queue)
 +{
 +    VirtQueue *vq = svq->vq;
 +
 +    /* Forward as many used buffers as possible. */
 +    do {
 +        unsigned i = 0;
 +
 +        vhost_svq_disable_notification(svq);
 +        while (true) {
 +            uint32_t len;
 +            g_autofree VirtQueueElement *elem = vhost_svq_get_buf(svq, &len);
 +            if (!elem) {
 +                break;
 +            }
 +
 +            if (unlikely(i >= svq->vring.num)) {
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                         "More than %u used buffers obtained in a %u size SVQ",
 +                         i, svq->vring.num);
 +                virtqueue_fill(vq, elem, len, i);
 +                virtqueue_flush(vq, i);
 +                return;
 +            }
 +            virtqueue_fill(vq, elem, len, i++);
 +        }
 +
 +        virtqueue_flush(vq, i);
 +        event_notifier_set(&svq->svq_call);
 +
 +        if (check_for_avail_queue && svq->next_guest_avail_elem) {
 +            /*
 +             * Avail ring was full when vhost_svq_flush was called, so it's a
 +             * good moment to make more descriptors available if possible.
 +             */
 +            vhost_handle_guest_kick(svq);
 +        }
 +    } while (!vhost_svq_enable_notification(svq));
 +}
 +
 +/**
 + * Forward used buffers.
   *
   * @n: hdev call event notifier, the one that device set to notify svq.
 + *
 + * Note that we are not making any buffers available in the loop, there is no
 + * way that it runs more than virtqueue size times.
   */
  static void vhost_svq_handle_call(EventNotifier *n)
  {
      VhostShadowVirtqueue *svq = container_of(n, VhostShadowVirtqueue,
                                               hdev_call);
      event_notifier_test_and_clear(n);
 -    event_notifier_set(&svq->svq_call);
 +    vhost_svq_flush(svq, true);
  }
-+static gboolean net_stream_send(QIOChannel *ioc,
+ /**
-+                                GIOCondition condition,
+@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd)
-+                                gpointer data);
+     if (poll_start) {
-+
+         event_notifier_init_fd(svq_kick, svq_kick_fd);
- static void net_stream_send_completed(NetClientState *nc, ssize_t len)
+         event_notifier_set(svq_kick);
- {
+-        event_notifier_set_handler(svq_kick, vhost_handle_guest_kick);
-     NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
++        event_notifier_set_handler(svq_kick, vhost_handle_guest_kick_notifier);
++    }
--    if (!s->read_poll) {
++}
--        net_stream_read_poll(s, true);
++
-+    if (!s->ioc_read_tag) {
++/**
-+        s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN,
++ * Start the shadow virtqueue operation.
-+                                                net_stream_send, s, NULL);
++ *
 + * @svq: Shadow Virtqueue
 + * @vdev: VirtIO device
 + * @vq: Virtqueue to shadow
 + */
 +void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
 +                     VirtQueue *vq)
 +{
 +    size_t desc_size, driver_size, device_size;
 +
 +    svq->next_guest_avail_elem = NULL;
 +    svq->shadow_avail_idx = 0;
 +    svq->shadow_used_idx = 0;
 +    svq->last_used_idx = 0;
 +    svq->vdev = vdev;
 +    svq->vq = vq;
 +
 +    svq->vring.num = virtio_queue_get_num(vdev, virtio_get_queue_index(vq));
 +    driver_size = vhost_svq_driver_area_size(svq);
 +    device_size = vhost_svq_device_area_size(svq);
 +    svq->vring.desc = qemu_memalign(qemu_real_host_page_size, driver_size);
 +    desc_size = sizeof(vring_desc_t) * svq->vring.num;
 +    svq->vring.avail = (void *)((char *)svq->vring.desc + desc_size);
 +    memset(svq->vring.desc, 0, driver_size);
 +    svq->vring.used = qemu_memalign(qemu_real_host_page_size, device_size);
 +    memset(svq->vring.used, 0, device_size);
 +    svq->ring_id_maps = g_new0(VirtQueueElement *, svq->vring.num);
 +    for (unsigned i = 0; i < svq->vring.num - 1; i++) {
 +        svq->vring.desc[i].next = cpu_to_le16(i + 1);
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void net_stream_rs_finalize(SocketReadState *rs)
+@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd)
-     if (qemu_send_packet_async(&s->nc, rs->buf,
+ void vhost_svq_stop(VhostShadowVirtqueue *svq)
-                                rs->packet_len,
+ {
-                                net_stream_send_completed) == 0) {
+     event_notifier_set_handler(&svq->svq_kick, NULL);
--        net_stream_read_poll(s, false);
++    g_autofree VirtQueueElement *next_avail_elem = NULL;
-+        if (s->ioc_read_tag) {
++
-+            g_source_remove(s->ioc_read_tag);
++    if (!svq->vq) {
-+            s->ioc_read_tag = 0;
++        return;
-+        }
++    }
 +
 +    /* Send all pending used descriptors to guest */
 +    vhost_svq_flush(svq, false);
 +
 +    for (unsigned i = 0; i < svq->vring.num; ++i) {
 +        g_autofree VirtQueueElement *elem = NULL;
 +        elem = g_steal_pointer(&svq->ring_id_maps[i]);
 +        if (elem) {
 +            virtqueue_detach_element(svq->vq, elem, 0);
 +        }
 +    }
 +
 +    next_avail_elem = g_steal_pointer(&svq->next_guest_avail_elem);
 +    if (next_avail_elem) {
 +        virtqueue_detach_element(svq->vq, next_avail_elem, 0);
 +    }
 +    svq->vq = NULL;
 +    g_free(svq->ring_id_maps);
 +    qemu_vfree(svq->vring.desc);
 +    qemu_vfree(svq->vring.used);
  }
  /**
 diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.h
 +++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
      /* Guest's call notifier, where the SVQ calls guest. */
      EventNotifier svq_call;
 +
 +    /* Virtio queue shadowing */
 +    VirtQueue *vq;
 +
 +    /* Virtio device */
 +    VirtIODevice *vdev;
 +
 +    /* Map for use the guest's descriptors */
 +    VirtQueueElement **ring_id_maps;
 +
 +    /* Next VirtQueue element that guest made available */
 +    VirtQueueElement *next_guest_avail_elem;
 +
 +    /* Next head to expose to the device */
 +    uint16_t shadow_avail_idx;
 +
 +    /* Next free descriptor */
 +    uint16_t free_head;
 +
 +    /* Last seen used idx */
 +    uint16_t shadow_used_idx;
 +
 +    /* Next head to consume from the device */
 +    uint16_t last_used_idx;
  } VhostShadowVirtqueue;
  bool vhost_svq_valid_features(uint64_t features, Error **errp);
@@ -XXX,XX +XXX,XX @@ void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
  size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq);
  size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq);
 +void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
 +                     VirtQueue *vq);
  void vhost_svq_stop(VhostShadowVirtqueue *svq);
  VhostShadowVirtqueue *vhost_svq_new(void);
 diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-vdpa.c
 +++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_addr(struct vhost_dev *dev,
   * Note that this function does not rewind kick file descriptor if cannot set
   * call one.
   */
 -static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
 -                                 VhostShadowVirtqueue *svq, unsigned idx,
 -                                 Error **errp)
 +static int vhost_vdpa_svq_set_fds(struct vhost_dev *dev,
 +                                  VhostShadowVirtqueue *svq, unsigned idx,
 +                                  Error **errp)
  {
      struct vhost_vring_file file = {
          .index = dev->vq_index + idx,
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
      r = vhost_vdpa_set_vring_dev_kick(dev, &file);
      if (unlikely(r != 0)) {
          error_setg_errno(errp, -r, "Can't set device kick fd");
 -        return false;
 +        return r;
      }
+     event_notifier = &svq->hdev_call;
+@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
+         error_setg_errno(errp, -r, "Can't set device call fd");
+     }
++    return r;
++}
++
++/**
++ * Unmap a SVQ area in the device
++ */
++static bool vhost_vdpa_svq_unmap_ring(struct vhost_vdpa *v, hwaddr iova,
++                                      hwaddr size)
++{
++    int r;
++
++    size = ROUND_UP(size, qemu_real_host_page_size);
++    r = vhost_vdpa_dma_unmap(v, iova, size);
++    return r == 0;
++}
++
++static bool vhost_vdpa_svq_unmap_rings(struct vhost_dev *dev,
++                                       const VhostShadowVirtqueue *svq)
++{
++    struct vhost_vdpa *v = dev->opaque;
++    struct vhost_vring_addr svq_addr;
++    size_t device_size = vhost_svq_device_area_size(svq);
++    size_t driver_size = vhost_svq_driver_area_size(svq);
++    bool ok;
++
++    vhost_svq_get_vring_addr(svq, &svq_addr);
++
++    ok = vhost_vdpa_svq_unmap_ring(v, svq_addr.desc_user_addr, driver_size);
++    if (unlikely(!ok)) {
++        return false;
++    }
++
++    return vhost_vdpa_svq_unmap_ring(v, svq_addr.used_user_addr, device_size);
++}
++
++/**
++ * Map the shadow virtqueue rings in the device
++ *
++ * @dev: The vhost device
++ * @svq: The shadow virtqueue
++ * @addr: Assigned IOVA addresses
++ * @errp: Error pointer
++ */
++static bool vhost_vdpa_svq_map_rings(struct vhost_dev *dev,
++                                     const VhostShadowVirtqueue *svq,
++                                     struct vhost_vring_addr *addr,
++                                     Error **errp)
++{
++    struct vhost_vdpa *v = dev->opaque;
++    size_t device_size = vhost_svq_device_area_size(svq);
++    size_t driver_size = vhost_svq_driver_area_size(svq);
++    int r;
++
++    ERRP_GUARD();
++    vhost_svq_get_vring_addr(svq, addr);
++
++    r = vhost_vdpa_dma_map(v, addr->desc_user_addr, driver_size,
++                           (void *)(uintptr_t)addr->desc_user_addr, true);
++    if (unlikely(r != 0)) {
++        error_setg_errno(errp, -r, "Cannot create vq driver region: ");
++        return false;
++    }
++
++    r = vhost_vdpa_dma_map(v, addr->used_user_addr, device_size,
++                           (void *)(intptr_t)addr->used_user_addr, false);
++    if (unlikely(r != 0)) {
++        error_setg_errno(errp, -r, "Cannot create vq device region: ");
++    }
++
++    return r == 0;
++}
++
++static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
++                                 VhostShadowVirtqueue *svq, unsigned idx,
++                                 Error **errp)
++{
++    uint16_t vq_index = dev->vq_index + idx;
++    struct vhost_vring_state s = {
++        .index = vq_index,
++    };
++    int r;
++
++    r = vhost_vdpa_set_dev_vring_base(dev, &s);
++    if (unlikely(r)) {
++        error_setg_errno(errp, -r, "Cannot set vring base");
++        return false;
++    }
++
++    r = vhost_vdpa_svq_set_fds(dev, svq, idx, errp);
+     return r == 0;
  }
--static void net_stream_send(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svqs_start(struct vhost_dev *dev)
-+static gboolean net_stream_send(QIOChannel *ioc,
+     }
-+                                GIOCondition condition,
-+                                gpointer data)
+     for (i = 0; i < v->shadow_vqs->len; ++i) {
- {
++        VirtQueue *vq = virtio_get_queue(dev->vdev, dev->vq_index + i);
--    NetStreamState *s = opaque;
+         VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, i);
-+    NetStreamState *s = data;
++        struct vhost_vring_addr addr = {
-     int size;
++            .index = i,
-     int ret;
++        };
--    uint8_t buf1[NET_BUFSIZE];
++        int r;
--    const uint8_t *buf;
+         bool ok = vhost_vdpa_svq_setup(dev, svq, i, &err);
-+    char buf1[NET_BUFSIZE];
+         if (unlikely(!ok)) {
-+    const char *buf;
+-            error_reportf_err(err, "Cannot setup SVQ %u: ", i);
++            goto err;
--    size = recv(s->fd, buf1, sizeof(buf1), 0);
++        }
-+    size = qio_channel_read(s->ioc, buf1, sizeof(buf1), NULL);
++
-     if (size < 0) {
++        vhost_svq_start(svq, dev->vdev, vq);
-         if (errno != EWOULDBLOCK) {
++        ok = vhost_vdpa_svq_map_rings(dev, svq, &addr, &err);
-             goto eoc;
++        if (unlikely(!ok)) {
-@@ -XXX,XX +XXX,XX @@ static void net_stream_send(void *opaque)
++            goto err_map;
-     } else if (size == 0) {
++        }
-         /* end of connection */
++
-     eoc:
++        /* Override vring GPA set by vhost subsystem */
--        net_stream_read_poll(s, false);
++        r = vhost_vdpa_set_vring_dev_addr(dev, &addr);
--        net_stream_write_poll(s, false);
++        if (unlikely(r != 0)) {
--        if (s->listen_fd != -1) {
++            error_setg_errno(&err, -r, "Cannot set device address");
--            qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
++            goto err_set_addr;
-+        s->ioc_read_tag = 0;
++        }
-+        if (s->ioc_write_tag) {
++    }
-+            g_source_remove(s->ioc_write_tag);
++
-+            s->ioc_write_tag = 0;
++    return true;
 +
 +err_set_addr:
 +    vhost_vdpa_svq_unmap_rings(dev, g_ptr_array_index(v->shadow_vqs, i));
 +
 +err_map:
 +    vhost_svq_stop(g_ptr_array_index(v->shadow_vqs, i));
 +
 +err:
 +    error_reportf_err(err, "Cannot setup SVQ %u: ", i);
 +    for (unsigned j = 0; j < i; ++j) {
 +        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, j);
 +        vhost_vdpa_svq_unmap_rings(dev, svq);
 +        vhost_svq_stop(svq);
 +    }
 +
 +    return false;
 +}
 +
 +static bool vhost_vdpa_svqs_stop(struct vhost_dev *dev)
 +{
 +    struct vhost_vdpa *v = dev->opaque;
 +
 +    if (!v->shadow_vqs) {
 +        return true;
 +    }
 +
 +    for (unsigned i = 0; i < v->shadow_vqs->len; ++i) {
 +        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, i);
 +        bool ok = vhost_vdpa_svq_unmap_rings(dev, svq);
 +        if (unlikely(!ok)) {
              return false;
          }
--        closesocket(s->fd);
-+        if (s->listener) {
-+            qio_net_listener_set_client_func(s->listener, net_stream_listen,
-+                                             s, NULL);
-+        }
-+        object_unref(OBJECT(s->ioc));
-+        s->ioc = NULL;
--        s->fd = -1;
-         net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
-         s->nc.link_down = true;
-         qemu_set_info_str(&s->nc, "");
--        return;
-+        return G_SOURCE_REMOVE;
      }
-     buf = buf1;
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
+         }
--    ret = net_fill_rstate(&s->rs, buf, size);
+         vhost_vdpa_set_vring_ready(dev);
-+    ret = net_fill_rstate(&s->rs, (const uint8_t *)buf, size);
+     } else {
++        ok = vhost_vdpa_svqs_stop(dev);
-     if (ret == -1) {
++        if (unlikely(!ok)) {
-         goto eoc;
++            return -1;
 +        }
          vhost_vdpa_host_notifiers_uninit(dev, dev->nvqs);
      }
-+
 +    return G_SOURCE_CONTINUE;
  }
  static void net_stream_cleanup(NetClientState *nc)
  {
      NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
 -    if (s->fd != -1) {
 -        net_stream_read_poll(s, false);
 -        net_stream_write_poll(s, false);
 -        close(s->fd);
 -        s->fd = -1;
 +    if (s->ioc) {
 +        if (QIO_CHANNEL_SOCKET(s->ioc)->fd != -1) {
 +            if (s->ioc_read_tag) {
 +                g_source_remove(s->ioc_read_tag);
 +                s->ioc_read_tag = 0;
 +            }
 +            if (s->ioc_write_tag) {
 +                g_source_remove(s->ioc_write_tag);
 +                s->ioc_write_tag = 0;
 +            }
 +        }
 +        object_unref(OBJECT(s->ioc));
 +        s->ioc = NULL;
      }
 -    if (s->listen_fd != -1) {
 -        qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
 -        closesocket(s->listen_fd);
 -        s->listen_fd = -1;
 +    if (s->listen_ioc) {
 +        if (s->listener) {
 +            qio_net_listener_disconnect(s->listener);
 +            object_unref(OBJECT(s->listener));
 +            s->listener = NULL;
 +        }
 +        object_unref(OBJECT(s->listen_ioc));
 +        s->listen_ioc = NULL;
      }
  }
 -static void net_stream_connect(void *opaque)
 -{
 -    NetStreamState *s = opaque;
 -    net_stream_read_poll(s, true);
 -}
 -
  static NetClientInfo net_stream_info = {
      .type = NET_CLIENT_DRIVER_STREAM,
      .size = sizeof(NetStreamState),
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_stream_info = {
      .cleanup = net_stream_cleanup,
  };
 -static NetStreamState *net_stream_fd_init(NetClientState *peer,
 -                                          const char *model,
 -                                          const char *name,
 -                                          int fd, int is_connected)
 +static void net_stream_listen(QIONetListener *listener,
 +                              QIOChannelSocket *cioc,
 +                              void *opaque)
  {
 -    NetClientState *nc;
 -    NetStreamState *s;
 -
 -    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
 +    NetStreamState *s = opaque;
 +    SocketAddress *addr;
 +    char *uri;
 -    qemu_set_info_str(nc, "fd=%d", fd);
 +    object_ref(OBJECT(cioc));
 -    s = DO_UPCAST(NetStreamState, nc, nc);
 +    qio_net_listener_set_client_func(s->listener, NULL, s, NULL);
 -    s->fd = fd;
 -    s->listen_fd = -1;
 -    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
 +    s->ioc = QIO_CHANNEL(cioc);
 +    qio_channel_set_name(s->ioc, "stream-server");
 +    s->nc.link_down = false;
 -    /* Disable Nagle algorithm on TCP sockets to reduce latency */
 -    socket_set_nodelay(fd);
 +    s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
 +                                            s, NULL);
 -    if (is_connected) {
 -        net_stream_connect(s);
 +    if (cioc->localAddr.ss_family == AF_UNIX) {
 +        addr = qio_channel_socket_get_local_address(cioc, NULL);
      } else {
 -        qemu_set_fd_handler(s->fd, NULL, net_stream_connect, s);
 +        addr = qio_channel_socket_get_remote_address(cioc, NULL);
      }
 -    return s;
 +    g_assert(addr != NULL);
 +    uri = socket_uri(addr);
 +    qemu_set_info_str(&s->nc, uri);
 +    g_free(uri);
 +    qapi_free_SocketAddress(addr);
  }
 -static void net_stream_accept(void *opaque)
 +static void net_stream_server_listening(QIOTask *task, gpointer opaque)
  {
      NetStreamState *s = opaque;
 -    struct sockaddr_storage saddr;
 -    socklen_t len;
 -    int fd;
 -
 -    for (;;) {
 -        len = sizeof(saddr);
 -        fd = qemu_accept(s->listen_fd, (struct sockaddr *)&saddr, &len);
 -        if (fd < 0 && errno != EINTR) {
 -            return;
 -        } else if (fd >= 0) {
 -            qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
 -            break;
 -        }
 -    }
 +    QIOChannelSocket *listen_sioc = QIO_CHANNEL_SOCKET(s->listen_ioc);
 +    SocketAddress *addr;
 +    int ret;
 -    s->fd = fd;
 -    s->nc.link_down = false;
 -    net_stream_connect(s);
 -    switch (saddr.ss_family) {
 -    case AF_INET: {
 -        struct sockaddr_in *saddr_in = (struct sockaddr_in *)&saddr;
 -
 -        qemu_set_info_str(&s->nc, "connection from %s:%d",
 -                          inet_ntoa(saddr_in->sin_addr),
 -                          ntohs(saddr_in->sin_port));
 -        break;
 +    if (listen_sioc->fd < 0) {
 +        qemu_set_info_str(&s->nc, "connection error");
 +        return;
      }
 -    case AF_UNIX: {
 -        struct sockaddr_un saddr_un;
 -        len = sizeof(saddr_un);
 -        getsockname(s->listen_fd, (struct sockaddr *)&saddr_un, &len);
 -        qemu_set_info_str(&s->nc, "connect from %s", saddr_un.sun_path);
 -        break;
 -    }
 -    default:
 -        g_assert_not_reached();
 +    addr = qio_channel_socket_get_local_address(listen_sioc, NULL);
 +    g_assert(addr != NULL);
 +    ret = qemu_socket_try_set_nonblock(listen_sioc->fd);
 +    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
 +        qemu_set_info_str(&s->nc, "can't use file descriptor %s (errno %d)",
 +                          addr->u.fd.str, -ret);
 +        return;
      }
 +    g_assert(ret == 0);
 +    qapi_free_SocketAddress(addr);
 +
 +    s->nc.link_down = true;
 +    s->listener = qio_net_listener_new();
 +
 +    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
 +    qio_net_listener_set_client_func(s->listener, net_stream_listen, s, NULL);
 +    qio_net_listener_add(s->listener, listen_sioc);
  }
  static int net_stream_server_init(NetClientState *peer,
@@ -XXX,XX +XXX,XX @@ static int net_stream_server_init(NetClientState *peer,
  {
      NetClientState *nc;
      NetStreamState *s;
 -    int fd, ret;
 +    QIOChannelSocket *listen_sioc = qio_channel_socket_new();
 -    switch (addr->type) {
 -    case SOCKET_ADDRESS_TYPE_INET: {
 -        struct sockaddr_in saddr_in;
 -
 -        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
 -                              errp) < 0) {
 -            return -1;
 -        }
 -
 -        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
 -        if (fd < 0) {
 -            error_setg_errno(errp, errno, "can't create stream socket");
 -            return -1;
 -        }
 -        qemu_socket_set_nonblock(fd);
 +    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
 +    s = DO_UPCAST(NetStreamState, nc, nc);
 -        socket_set_fast_reuse(fd);
 +    s->listen_ioc = QIO_CHANNEL(listen_sioc);
 +    qio_channel_socket_listen_async(listen_sioc, addr, 0,
 +                                    net_stream_server_listening, s,
 +                                    NULL, NULL);
 -        ret = bind(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
 -        if (ret < 0) {
 -            error_setg_errno(errp, errno, "can't bind ip=%s to socket",
 -                             inet_ntoa(saddr_in.sin_addr));
 -            closesocket(fd);
 -            return -1;
 -        }
 -        break;
 -    }
 -    case SOCKET_ADDRESS_TYPE_UNIX: {
 -        struct sockaddr_un saddr_un;
 -
 -        ret = unlink(addr->u.q_unix.path);
 -        if (ret < 0 && errno != ENOENT) {
 -            error_setg_errno(errp, errno, "failed to unlink socket %s",
 -                             addr->u.q_unix.path);
 -            return -1;
 -        }
 +    return 0;
 +}
 -        saddr_un.sun_family = PF_UNIX;
 -        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
 -                       addr->u.q_unix.path);
 -        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
 -            error_setg(errp, "UNIX socket path '%s' is too long",
 -                       addr->u.q_unix.path);
 -            error_append_hint(errp, "Path must be less than %zu bytes\n",
 -                              sizeof(saddr_un.sun_path));
 -            return -1;
 -        }
 +static void net_stream_client_connected(QIOTask *task, gpointer opaque)
 +{
 +    NetStreamState *s = opaque;
 +    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(s->ioc);
 +    SocketAddress *addr;
 +    gchar *uri;
 +    int ret;
 -        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
 -        if (fd < 0) {
 -            error_setg_errno(errp, errno, "can't create stream socket");
 -            return -1;
 -        }
 -        qemu_socket_set_nonblock(fd);
 -
 -        ret = bind(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
 -        if (ret < 0) {
 -            error_setg_errno(errp, errno, "can't create socket with path: %s",
 -                             saddr_un.sun_path);
 -            closesocket(fd);
 -            return -1;
 -        }
 -        break;
 -    }
 -    case SOCKET_ADDRESS_TYPE_FD:
 -        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
 -        if (fd == -1) {
 -            return -1;
 -        }
 -        ret = qemu_socket_try_set_nonblock(fd);
 -        if (ret < 0) {
 -            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
 -                             name, fd);
 -            return -1;
 -        }
 -        break;
 -    default:
 -        error_setg(errp, "only support inet or fd type");
 -        return -1;
 +    if (sioc->fd < 0) {
 +        qemu_set_info_str(&s->nc, "connection error");
 +        goto error;
      }
 -    ret = listen(fd, 0);
 -    if (ret < 0) {
 -        error_setg_errno(errp, errno, "can't listen on socket");
 -        closesocket(fd);
 -        return -1;
 +    addr = qio_channel_socket_get_remote_address(sioc, NULL);
 +    g_assert(addr != NULL);
 +    uri = socket_uri(addr);
 +    qemu_set_info_str(&s->nc, uri);
 +    g_free(uri);
 +
 +    ret = qemu_socket_try_set_nonblock(sioc->fd);
 +    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
 +        qemu_set_info_str(&s->nc, "can't use file descriptor %s (errno %d)",
 +                          addr->u.fd.str, -ret);
 +        qapi_free_SocketAddress(addr);
 +        goto error;
      }
 +    g_assert(ret == 0);
 -    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
 -    s = DO_UPCAST(NetStreamState, nc, nc);
 -    s->fd = -1;
 -    s->listen_fd = fd;
 -    s->nc.link_down = true;
      net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
 -    qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
 -    return 0;
 +    /* Disable Nagle algorithm on TCP sockets to reduce latency */
 +    qio_channel_set_delay(s->ioc, false);
 +
 +    s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
 +                                            s, NULL);
 +    s->nc.link_down = false;
 +    qapi_free_SocketAddress(addr);
 +
 +    return;
 +error:
 +    object_unref(OBJECT(s->ioc));
 +    s->ioc = NULL;
  }
  static int net_stream_client_init(NetClientState *peer,
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
                                    Error **errp)
  {
      NetStreamState *s;
 -    struct sockaddr_in saddr_in;
 -    struct sockaddr_un saddr_un;
 -    int fd, connected, ret;
 -
 -    switch (addr->type) {
 -    case SOCKET_ADDRESS_TYPE_INET:
 -        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
 -                              errp) < 0) {
 -            return -1;
 -        }
 +    NetClientState *nc;
 +    QIOChannelSocket *sioc = qio_channel_socket_new();
 -        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
 -        if (fd < 0) {
 -            error_setg_errno(errp, errno, "can't create stream socket");
 -            return -1;
 -        }
 -        qemu_socket_set_nonblock(fd);
 -
 -        connected = 0;
 -        for (;;) {
 -            ret = connect(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
 -            if (ret < 0) {
 -                if (errno == EINTR || errno == EWOULDBLOCK) {
 -                    /* continue */
 -                } else if (errno == EINPROGRESS ||
 -                           errno == EALREADY) {
 -                    break;
 -                } else {
 -                    error_setg_errno(errp, errno, "can't connect socket");
 -                    closesocket(fd);
 -                    return -1;
 -                }
 -            } else {
 -                connected = 1;
 -                break;
 -            }
 -        }
 -        break;
 -    case SOCKET_ADDRESS_TYPE_UNIX:
 -        saddr_un.sun_family = PF_UNIX;
 -        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
 -                       addr->u.q_unix.path);
 -        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
 -            error_setg(errp, "UNIX socket path '%s' is too long",
 -                       addr->u.q_unix.path);
 -            error_append_hint(errp, "Path must be less than %zu bytes\n",
 -                              sizeof(saddr_un.sun_path));
 -            return -1;
 -        }
 +    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
 +    s = DO_UPCAST(NetStreamState, nc, nc);
 -        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
 -        if (fd < 0) {
 -            error_setg_errno(errp, errno, "can't create stream socket");
 -            return -1;
 -        }
 -        qemu_socket_set_nonblock(fd);
 -
 -        connected = 0;
 -        for (;;) {
 -            ret = connect(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
 -            if (ret < 0) {
 -                if (errno == EINTR || errno == EWOULDBLOCK) {
 -                    /* continue */
 -                } else if (errno == EAGAIN ||
 -                           errno == EALREADY) {
 -                    break;
 -                } else {
 -                    error_setg_errno(errp, errno, "can't connect socket");
 -                    closesocket(fd);
 -                    return -1;
 -                }
 -            } else {
 -                connected = 1;
 -                break;
 -            }
 -        }
 -        break;
 -    case SOCKET_ADDRESS_TYPE_FD:
 -        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
 -        if (fd == -1) {
 -            return -1;
 -        }
 -        ret = qemu_socket_try_set_nonblock(fd);
 -        if (ret < 0) {
 -            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
 -                             name, fd);
 -            return -1;
 -        }
 -        connected = 1;
 -        break;
 -    default:
 -        error_setg(errp, "only support inet, unix or fd type");
 -        return -1;
 -    }
 +    s->ioc = QIO_CHANNEL(sioc);
 +    s->nc.link_down = true;
 +
 +    qio_channel_socket_connect_async(sioc, addr,
 +                                     net_stream_client_connected, s,
 +                                     NULL, NULL);
 -    s = net_stream_fd_init(peer, model, name, fd, connected);
 -
 -    switch (addr->type) {
 -    case SOCKET_ADDRESS_TYPE_INET:
 -        qemu_set_info_str(&s->nc, "connect to %s:%d",
 -                          inet_ntoa(saddr_in.sin_addr),
 -                          ntohs(saddr_in.sin_port));
 -        break;
 -    case SOCKET_ADDRESS_TYPE_UNIX:
 -        qemu_set_info_str(&s->nc, " connect to %s", saddr_un.sun_path);
 -        break;
 -    case SOCKET_ADDRESS_TYPE_FD:
 -        qemu_set_info_str(&s->nc, "connect to fd %d", fd);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
      return 0;
  }
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
      "-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]\n"
      "                configure a network backend to connect to another network\n"
      "                using an UDP tunnel\n"
 -    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port\n"
 -    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path\n"
 +    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off]\n"
 +    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off]\n"
      "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
      "                configure a network backend to connect to another network\n"
      "                using a socket connection in stream mode.\n"
 --
 .7.4

-[PULL 20/26] net: dgram: make dgram_dst generic
+[PULL V3 09/15] util: Add iova_tree_alloc_map
-From: Laurent Vivier <lvivier@redhat.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-dgram_dst is a sockaddr_in structure. To be able to use it with
+This iova tree function allows it to look for a hole in allocated
-unix socket, use a pointer to a generic sockaddr structure.
+regions and return a totally new translation for a given translated
+address.
-Rename it dest_addr, and store socket length in dest_len.
+It's usage is mainly to allow devices to access qemu address space,
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+remapping guest's one into a new iova space where qemu can add chunks of
-Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+addresses.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/dgram.c | 82 +++++++++++++++++++++++++++++++++++++++----------------------
+ include/qemu/iova-tree.h |  18 +++++++
-file changed, 53 insertions(+), 29 deletions(-)
+ util/iova-tree.c         | 136 +++++++++++++++++++++++++++++++++++++++++++++++
+files changed, 154 insertions(+)
-diff --git a/net/dgram.c b/net/dgram.c
 diff --git a/include/qemu/iova-tree.h b/include/qemu/iova-tree.h
 index XXXXXXX..XXXXXXX 100644
---- a/net/dgram.c
+--- a/include/qemu/iova-tree.h
-+++ b/net/dgram.c
++++ b/include/qemu/iova-tree.h
-@@ -XXX,XX +XXX,XX @@ typedef struct NetDgramState {
+@@ -XXX,XX +XXX,XX @@
-     NetClientState nc;
+ #define  IOVA_OK           (0)
-     int fd;
+ #define  IOVA_ERR_INVALID  (-1) /* Invalid parameters */
-     SocketReadState rs;
+ #define  IOVA_ERR_OVERLAP  (-2) /* IOVA range overlapped */
--    struct sockaddr_in dgram_dst; /* contains destination iff connectionless */
++#define  IOVA_ERR_NOMEM    (-3) /* Cannot allocate */
-     bool read_poll;               /* waiting to receive data? */
-     bool write_poll;              /* waiting to transmit data? */
+ typedef struct IOVATree IOVATree;
-+    /* contains destination iff connectionless */
+ typedef struct DMAMap {
-+    struct sockaddr *dest_addr;
+@@ -XXX,XX +XXX,XX @@ const DMAMap *iova_tree_find_address(const IOVATree *tree, hwaddr iova);
-+    socklen_t dest_len;
+ void iova_tree_foreach(IOVATree *tree, iova_tree_iterator iterator);
- } NetDgramState;
+ /**
- static void net_dgram_send(void *opaque);
++ * iova_tree_alloc_map:
-@@ -XXX,XX +XXX,XX @@ static ssize_t net_dgram_receive(NetClientState *nc,
++ *
-     ssize_t ret;
++ * @tree: the iova tree to allocate from
++ * @map: the new map (as translated addr & size) to allocate in the iova region
-     do {
++ * @iova_begin: the minimum address of the allocation
--        if (s->dgram_dst.sin_family != AF_UNIX) {
++ * @iova_end: the maximum addressable direction of the allocation
--            ret = sendto(s->fd, buf, size, 0,
++ *
--                         (struct sockaddr *)&s->dgram_dst,
++ * Allocates a new region of a given size, between iova_min and iova_max.
--                         sizeof(s->dgram_dst));
++ *
-+        if (s->dest_addr) {
++ * Return: Same as iova_tree_insert, but cannot overlap and can return error if
-+            ret = sendto(s->fd, buf, size, 0, s->dest_addr, s->dest_len);
++ * iova tree is out of free contiguous range. The caller gets the assigned iova
-         } else {
++ * in map->iova.
-             ret = send(s->fd, buf, size, 0);
++ */
-         }
++int iova_tree_alloc_map(IOVATree *tree, DMAMap *map, hwaddr iova_begin,
-@@ -XXX,XX +XXX,XX @@ static void net_dgram_cleanup(NetClientState *nc)
++                        hwaddr iova_end);
-         close(s->fd);
++
-         s->fd = -1;
++/**
-     }
+  * iova_tree_destroy:
-+    g_free(s->dest_addr);
+  *
-+    s->dest_addr = NULL;
+  * @tree: the iova tree to destroy
-+    s->dest_len = 0;
+diff --git a/util/iova-tree.c b/util/iova-tree.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/iova-tree.c
 +++ b/util/iova-tree.c
@@ -XXX,XX +XXX,XX @@ struct IOVATree {
      GTree *tree;
  };
 +/* Args to pass to iova_tree_alloc foreach function. */
 +struct IOVATreeAllocArgs {
 +    /* Size of the desired allocation */
 +    size_t new_size;
 +
 +    /* The minimum address allowed in the allocation */
 +    hwaddr iova_begin;
 +
 +    /* Map at the left of the hole, can be NULL if "this" is first one */
 +    const DMAMap *prev;
 +
 +    /* Map at the right of the hole, can be NULL if "prev" is the last one */
 +    const DMAMap *this;
 +
 +    /* If found, we fill in the IOVA here */
 +    hwaddr iova_result;
 +
 +    /* Whether have we found a valid IOVA */
 +    bool iova_found;
 +};
 +
 +/**
 + * Iterate args to the next hole
 + *
 + * @args: The alloc arguments
 + * @next: The next mapping in the tree. Can be NULL to signal the last one
 + */
 +static void iova_tree_alloc_args_iterate(struct IOVATreeAllocArgs *args,
 +                                         const DMAMap *next)
 +{
 +    args->prev = args->this;
 +    args->this = next;
 +}
 +
  static int iova_tree_compare(gconstpointer a, gconstpointer b, gpointer data)
  {
      const DMAMap *m1 = a, *m2 = b;
@@ -XXX,XX +XXX,XX @@ int iova_tree_remove(IOVATree *tree, const DMAMap *map)
      return IOVA_OK;
  }
- static NetClientInfo net_dgram_socket_info = {
++/**
-@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
++ * Try to find an unallocated IOVA range between prev and this elements.
-                                         SocketAddress *mcast,
++ *
-                                         Error **errp)
++ * @args: Arguments to allocation
 + *
 + * Cases:
 + *
 + * (1) !prev, !this: No entries allocated, always succeed
 + *
 + * (2) !prev, this: We're iterating at the 1st element.
 + *
 + * (3) prev, !this: We're iterating at the last element.
 + *
 + * (4) prev, this: this is the most common case, we'll try to find a hole
 + * between "prev" and "this" mapping.
 + *
 + * Note that this function assumes the last valid iova is HWADDR_MAX, but it
 + * searches linearly so it's easy to discard the result if it's not the case.
 + */
 +static void iova_tree_alloc_map_in_hole(struct IOVATreeAllocArgs *args)
 +{
 +    const DMAMap *prev = args->prev, *this = args->this;
 +    uint64_t hole_start, hole_last;
 +
 +    if (this && this->iova + this->size < args->iova_begin) {
 +        return;
 +    }
 +
 +    hole_start = MAX(prev ? prev->iova + prev->size + 1 : 0, args->iova_begin);
 +    hole_last = this ? this->iova : HWADDR_MAX;
 +
 +    if (hole_last - hole_start > args->new_size) {
 +        args->iova_result = hole_start;
 +        args->iova_found = true;
 +    }
 +}
 +
 +/**
 + * Foreach dma node in the tree, compare if there is a hole with its previous
 + * node (or minimum iova address allowed) and the node.
 + *
 + * @key: Node iterating
 + * @value: Node iterating
 + * @pargs: Struct to communicate with the outside world
 + *
 + * Return: false to keep iterating, true if needs break.
 + */
 +static gboolean iova_tree_alloc_traverse(gpointer key, gpointer value,
 +                                         gpointer pargs)
 +{
 +    struct IOVATreeAllocArgs *args = pargs;
 +    DMAMap *node = value;
 +
 +    assert(key == value);
 +
 +    iova_tree_alloc_args_iterate(args, node);
 +    iova_tree_alloc_map_in_hole(args);
 +    return args->iova_found;
 +}
 +
 +int iova_tree_alloc_map(IOVATree *tree, DMAMap *map, hwaddr iova_begin,
 +                        hwaddr iova_last)
 +{
 +    struct IOVATreeAllocArgs args = {
 +        .new_size = map->size,
 +        .iova_begin = iova_begin,
 +    };
 +
 +    if (unlikely(iova_last < iova_begin)) {
 +        return IOVA_ERR_INVALID;
 +    }
 +
 +    /*
 +     * Find a valid hole for the mapping
 +     *
 +     * Assuming low iova_begin, so no need to do a binary search to
 +     * locate the first node.
 +     *
 +     * TODO: Replace all this with g_tree_node_first/next/last when available
 +     * (from glib since 2.68). To do it with g_tree_foreach complicates the
 +     * code a lot.
 +     *
 +     */
 +    g_tree_foreach(tree->tree, iova_tree_alloc_traverse, &args);
 +    if (!args.iova_found) {
 +        /*
 +         * Either tree is empty or the last hole is still not checked.
 +         * g_tree_foreach does not compare (last, iova_last] range, so we check
 +         * it here.
 +         */
 +        iova_tree_alloc_args_iterate(&args, NULL);
 +        iova_tree_alloc_map_in_hole(&args);
 +    }
 +
 +    if (!args.iova_found || args.iova_result + map->size > iova_last) {
 +        return IOVA_ERR_NOMEM;
 +    }
 +
 +    map->iova = args.iova_result;
 +    return iova_tree_insert(tree, map);
 +}
 +
  void iova_tree_destroy(IOVATree *tree)
  {
--    struct sockaddr_in saddr;
+     g_tree_destroy(tree->tree);
 +    struct sockaddr_in *saddr = NULL;
      int newfd;
      NetClientState *nc;
      NetDgramState *s;
@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
      qapi_free_SocketAddress(sa);
      /*
 -     * fd passed: multicast: "learn" dgram_dst address from bound address and
 +     * fd passed: multicast: "learn" dest_addr address from bound address and
       * save it. Because this may be "shared" socket from a "master" process,
       * datagrams would be recv() by ONLY ONE process: we must "clone" this
       * dgram socket --jjo
       */
      if (is_fd && mcast != NULL) {
 -            if (convert_host_port(&saddr, mcast->u.inet.host,
 -                                  mcast->u.inet.port, errp) < 0) {
 +            saddr = g_new(struct sockaddr_in, 1);
 +
 +            if (convert_host_port(saddr, mcast->u.inet.host, mcast->u.inet.port,
 +                                  errp) < 0) {
                  goto err;
              }
              /* must be bound */
 -            if (saddr.sin_addr.s_addr == 0) {
 +            if (saddr->sin_addr.s_addr == 0) {
                  error_setg(errp, "can't setup multicast destination address");
                  goto err;
              }
              /* clone dgram socket */
 -            newfd = net_dgram_mcast_create(&saddr, NULL, errp);
 +            newfd = net_dgram_mcast_create(saddr, NULL, errp);
              if (newfd < 0) {
                  goto err;
              }
              /* clone newfd to fd, close newfd */
              dup2(newfd, fd);
              close(newfd);
 -
      }
      nc = qemu_new_net_client(&net_dgram_socket_info, peer, model, name);
@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
      net_dgram_read_poll(s, true);
      /* mcast: save bound address as dst */
 -    if (is_fd && mcast != NULL) {
 -        s->dgram_dst = saddr;
 +    if (saddr) {
 +        g_assert(s->dest_addr == NULL);
 +        s->dest_addr = (struct sockaddr *)saddr;
 +        s->dest_len = sizeof(*saddr);
          qemu_set_info_str(nc, "fd=%d (cloned mcast=%s:%d)", fd,
 -                          inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 +                          inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
      } else {
 -        if (sa_type == SOCKET_ADDRESS_TYPE_UNIX) {
 -            s->dgram_dst.sin_family = AF_UNIX;
 -        }
 -
          qemu_set_info_str(nc, "fd=%d %s", fd, SocketAddressType_str(sa_type));
      }
      return s;
  err:
 +    g_free(saddr);
      closesocket(fd);
      return NULL;
  }
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
  {
      NetDgramState *s;
      int fd, ret;
 -    struct sockaddr_in saddr;
 +    struct sockaddr_in *saddr;
      if (remote->type != SOCKET_ADDRESS_TYPE_INET) {
          error_setg(errp, "multicast only support inet type");
          return -1;
      }
 -    if (convert_host_port(&saddr, remote->u.inet.host, remote->u.inet.port,
 +    saddr = g_new(struct sockaddr_in, 1);
 +    if (convert_host_port(saddr, remote->u.inet.host, remote->u.inet.port,
                            errp) < 0) {
 +        g_free(saddr);
          return -1;
      }
      if (!local) {
 -        fd = net_dgram_mcast_create(&saddr, NULL, errp);
 +        fd = net_dgram_mcast_create(saddr, NULL, errp);
          if (fd < 0) {
 +            g_free(saddr);
              return -1;
          }
      } else {
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
              struct in_addr localaddr;
              if (inet_aton(local->u.inet.host, &localaddr) == 0) {
 +                g_free(saddr);
                  error_setg(errp, "localaddr '%s' is not a valid IPv4 address",
                             local->u.inet.host);
                  return -1;
              }
 -            fd = net_dgram_mcast_create(&saddr, &localaddr, errp);
 +            fd = net_dgram_mcast_create(saddr, &localaddr, errp);
              if (fd < 0) {
 +                g_free(saddr);
                  return -1;
              }
              break;
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
          case SOCKET_ADDRESS_TYPE_FD:
              fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
              if (fd == -1) {
 +                g_free(saddr);
                  return -1;
              }
              ret = qemu_socket_try_set_nonblock(fd);
              if (ret < 0) {
 +                g_free(saddr);
                  error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
                                   name, fd);
                  return -1;
              }
              break;
          default:
 +            g_free(saddr);
              error_setg(errp, "only support inet or fd type for local");
              return -1;
          }
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
                            local->type == SOCKET_ADDRESS_TYPE_FD,
                            remote, errp);
      if (!s) {
 +        g_free(saddr);
          return -1;
      }
 -    s->dgram_dst = saddr;
 +    g_assert(s->dest_addr == NULL);
 +    s->dest_addr = (struct sockaddr *)saddr;
 +    s->dest_len = sizeof(*saddr);
 +
 +    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr->sin_addr),
 +                      ntohs(saddr->sin_port));
 -    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr.sin_addr),
 -                      ntohs(saddr.sin_port));
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
  {
      NetDgramState *s;
      int fd, ret;
 -    struct sockaddr_in raddr_in;
 -    struct sockaddr_in laddr_in;
      SocketAddress *remote, *local;
 +    struct sockaddr *dest_addr;
 +    struct sockaddr_in laddr_in, raddr_in;
 +    socklen_t dest_len;
      assert(netdev->type == NET_CLIENT_DRIVER_DGRAM);
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
              return -1;
          }
          qemu_socket_set_nonblock(fd);
 +
 +        dest_len = sizeof(raddr_in);
 +        dest_addr = g_malloc(dest_len);
 +        memcpy(dest_addr, &raddr_in, dest_len);
          break;
      case SOCKET_ADDRESS_TYPE_FD:
          fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
                               name, fd);
              return -1;
          }
 +        dest_addr = NULL;
 +        dest_len = 0;
          break;
      default:
          error_setg(errp, "only support inet or fd type for local");
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
      }
      if (remote) {
 -        s->dgram_dst = raddr_in;
 +        g_assert(s->dest_addr == NULL);
 +        s->dest_addr = dest_addr;
 +        s->dest_len = dest_len;
      }
      switch (local->type) {
 --
 .7.4

-[PULL 04/26] vdpa: Remove shadow CVQ command check
+[PULL V3 10/15] util: add iova_tree_find_iova
 From: Eugenio Pérez <eperezma@redhat.com>
-The guest will see undefined behavior if it issue not negotiate
+This function does the reverse operation of iova_tree_find: To look for
-commands, bit it is expected somehow.
+a mapping that match a translated address so we can do the reverse.
-Simplify code deleting this check.
+This have linear complexity instead of logarithmic, but it supports
 overlapping HVA. Future developments could reduce it.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
-Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/vhost-vdpa.c | 48 ------------------------------------------------
+ include/qemu/iova-tree.h | 20 +++++++++++++++++++-
-file changed, 48 deletions(-)
+ util/iova-tree.c         | 34 ++++++++++++++++++++++++++++++++++
 files changed, 53 insertions(+), 1 deletion(-)
-diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
+diff --git a/include/qemu/iova-tree.h b/include/qemu/iova-tree.h
 index XXXXXXX..XXXXXXX 100644
---- a/net/vhost-vdpa.c
+--- a/include/qemu/iova-tree.h
-+++ b/net/vhost-vdpa.c
++++ b/include/qemu/iova-tree.h
-@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_vhost_vdpa_cvq_info = {
+@@ -XXX,XX +XXX,XX @@ int iova_tree_remove(IOVATree *tree, const DMAMap *map);
   * @tree: the iova tree to search from
   * @map: the mapping to search
   *
 - * Search for a mapping in the iova tree that overlaps with the
 + * Search for a mapping in the iova tree that iova overlaps with the
   * mapping range specified.  Only the first found mapping will be
   * returned.
   *
@@ -XXX,XX +XXX,XX @@ int iova_tree_remove(IOVATree *tree, const DMAMap *map);
  const DMAMap *iova_tree_find(const IOVATree *tree, const DMAMap *map);
  /**
 + * iova_tree_find_iova:
 + *
 + * @tree: the iova tree to search from
 + * @map: the mapping to search
 + *
 + * Search for a mapping in the iova tree that translated_addr overlaps with the
 + * mapping range specified.  Only the first found mapping will be
 + * returned.
 + *
 + * Return: DMAMap pointer if found, or NULL if not found.  Note that
 + * the returned DMAMap pointer is maintained internally.  User should
 + * only read the content but never modify or free the content.  Also,
 + * user is responsible to make sure the pointer is valid (say, no
 + * concurrent deletion in progress).
 + */
 +const DMAMap *iova_tree_find_iova(const IOVATree *tree, const DMAMap *map);
 +
 +/**
   * iova_tree_find_address:
   *
   * @tree: the iova tree to search from
 diff --git a/util/iova-tree.c b/util/iova-tree.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/iova-tree.c
 +++ b/util/iova-tree.c
@@ -XXX,XX +XXX,XX @@ struct IOVATreeAllocArgs {
      bool iova_found;
  };
++typedef struct IOVATreeFindIOVAArgs {
++    const DMAMap *needle;
++    const DMAMap *result;
++} IOVATreeFindIOVAArgs;
++
  /**
-- * Do not forward commands not supported by SVQ. Otherwise, the device could
+  * Iterate args to the next hole
 - * accept it and qemu would not know how to update the device model.
 - */
 -static bool vhost_vdpa_net_cvq_validate_cmd(const void *out_buf, size_t len)
 -{
 -    struct virtio_net_ctrl_hdr ctrl;
 -
 -    if (unlikely(len < sizeof(ctrl))) {
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "%s: invalid legnth of out buffer %zu\n", __func__, len);
 -        return false;
 -    }
 -
 -    memcpy(&ctrl, out_buf, sizeof(ctrl));
 -    switch (ctrl.class) {
 -    case VIRTIO_NET_CTRL_MAC:
 -        switch (ctrl.cmd) {
 -        case VIRTIO_NET_CTRL_MAC_ADDR_SET:
 -            return true;
 -        default:
 -            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid mac cmd %u\n",
 -                          __func__, ctrl.cmd);
 -        };
 -        break;
 -    case VIRTIO_NET_CTRL_MQ:
 -        switch (ctrl.cmd) {
 -        case VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET:
 -            return true;
 -        default:
 -            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid mq cmd %u\n",
 -                          __func__, ctrl.cmd);
 -        };
 -        break;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid control class %u\n",
 -                      __func__, ctrl.class);
 -    };
 -
 -    return false;
 -}
 -
 -/**
   * Validate and copy control virtqueue commands.
   *
-  * Following QEMU guidelines, we offer a copy of the buffers to the device to
+@@ -XXX,XX +XXX,XX @@ const DMAMap *iova_tree_find(const IOVATree *tree, const DMAMap *map)
-@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
+     return g_tree_lookup(tree->tree, map);
-         .iov_len = sizeof(status),
+ }
-     };
-     ssize_t dev_written = -EINVAL;
++static gboolean iova_tree_find_address_iterator(gpointer key, gpointer value,
--    bool ok;
++                                                gpointer data)
++{
-     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
++    const DMAMap *map = key;
-                              s->cvq_cmd_out_buffer,
++    IOVATreeFindIOVAArgs *args = data;
-                              vhost_vdpa_net_cvq_cmd_len());
++    const DMAMap *needle;
--    ok = vhost_vdpa_net_cvq_validate_cmd(s->cvq_cmd_out_buffer, out.iov_len);
++
--    if (unlikely(!ok)) {
++    g_assert(key == value);
--        goto out;
++
--    }
++    needle = args->needle;
--
++    if (map->translated_addr + map->size < needle->translated_addr ||
-     dev_written = vhost_vdpa_net_cvq_add(s, out.iov_len, sizeof(status));
++        needle->translated_addr + needle->size < map->translated_addr) {
-     if (unlikely(dev_written < 0)) {
++        return false;
-         goto out;
++    }
 +
 +    args->result = map;
 +    return true;
 +}
 +
 +const DMAMap *iova_tree_find_iova(const IOVATree *tree, const DMAMap *map)
 +{
 +    IOVATreeFindIOVAArgs args = {
 +        .needle = map,
 +    };
 +
 +    g_tree_foreach(tree->tree, iova_tree_find_address_iterator, &args);
 +    return args.result;
 +}
 +
  const DMAMap *iova_tree_find_address(const IOVATree *tree, hwaddr iova)
  {
      const DMAMap map = { .iova = iova, .size = 0 };
 --
 .7.4

-[PULL 16/26] qapi: net: add stream and dgram netdevs
+[PULL V3 11/15] vhost: Add VhostIOVATree
-From: Laurent Vivier <lvivier@redhat.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-Copied from socket netdev file and modified to use SocketAddress
+This tree is able to look for a translated address from an IOVA address.
 to be able to introduce new features like unix socket.
-"udp" and "mcast" are squashed into dgram netdev, multicast is detected
+At first glance it is similar to util/iova-tree. However, SVQ working on
-according to the IP address type.
+devices with limited IOVA space need more capabilities, like allocating
-"listen" and "connect" modes are managed by stream netdev. An optional
+IOVA chunks or performing reverse translations (qemu addresses to iova).
 parameter "server" defines the mode (off by default)
-The two new types need to be parsed the modern way with -netdev, because
+The allocation capability, as "assign a free IOVA address to this chunk
-with the traditional way, the "type" field of netdev structure collides with
+of memory in qemu's address space" allows shadow virtqueue to create a
-the "type" field of SocketAddress and prevents the correct evaluation of the
+new address space that is not restricted by guest's addressable one, so
-command line option. Moreover the traditional way doesn't allow to use
+we can allocate shadow vqs vrings outside of it.
 the same type (SocketAddress) several times with the -netdev option
 (needed to specify "local" and "remote" addresses).
-The previous commit paved the way for parsing the modern way, but
+It duplicates the tree so it can search efficiently in both directions,
-omitted one detail: how to pick modern vs. traditional, in
+and it will signal overlap if iova or the translated address is present
-netdev_is_modern().
+in any tree.
-We want to pick based on the value of parameter "type".  But how to
+Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 extract it from the option argument?
 Parsing the option argument, either the modern or the traditional way,
 extracts it for us, but only if parsing succeeds.
 If parsing fails, there is no good option.  No matter which parser we
 pick, it'll be the wrong one for some arguments, and the error
 reporting will be confusing.
 Fortunately, the traditional parser accepts *anything* when called in
 a certain way.  This maximizes our chance to extract the value of
 "type", and in turn minimizes the risk of confusing error reporting.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
 Acked-by: Markus Armbruster <armbru@redhat.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hmp-commands.hx |   2 +-
+ hw/virtio/meson.build       |   2 +-
- net/clients.h   |   6 +
+ hw/virtio/vhost-iova-tree.c | 110 ++++++++++++++++++++++++++++++++++++++++++++
- net/dgram.c     | 537 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ hw/virtio/vhost-iova-tree.h |  27 +++++++++++
- net/hub.c       |   2 +
+files changed, 138 insertions(+), 1 deletion(-)
- net/meson.build |   2 +
+ create mode 100644 hw/virtio/vhost-iova-tree.c
- net/net.c       |  30 +++-
+ create mode 100644 hw/virtio/vhost-iova-tree.h
  net/stream.c    | 425 ++++++++++++++++++++++++++++++++++++++++++++
  qapi/net.json   |  66 ++++++-
  qemu-options.hx |  12 ++
 files changed, 1078 insertions(+), 4 deletions(-)
  create mode 100644 net/dgram.c
  create mode 100644 net/stream.c
-diff --git a/hmp-commands.hx b/hmp-commands.hx
+diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hmp-commands.hx
+--- a/hw/virtio/meson.build
-+++ b/hmp-commands.hx
++++ b/hw/virtio/meson.build
-@@ -XXX,XX +XXX,XX @@ ERST
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ALL', if_true: files('vhost-stub.c'))
-     {
-         .name       = "netdev_add",
+ virtio_ss = ss.source_set()
-         .args_type  = "netdev:O",
+ virtio_ss.add(files('virtio.c'))
--        .params     = "[user|tap|socket|vde|bridge|hubport|netmap|vhost-user"
+-virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c', 'vhost-shadow-virtqueue.c'))
-+        .params     = "[user|tap|socket|stream|dgram|vde|bridge|hubport|netmap|vhost-user"
++virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c', 'vhost-shadow-virtqueue.c', 'vhost-iova-tree.c'))
- #ifdef CONFIG_VMNET
+ virtio_ss.add(when: 'CONFIG_VHOST_USER', if_true: files('vhost-user.c'))
-                       "|vmnet-host|vmnet-shared|vmnet-bridged"
+ virtio_ss.add(when: 'CONFIG_VHOST_VDPA', if_true: files('vhost-vdpa.c'))
- #endif
+ virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-balloon.c'))
-diff --git a/net/clients.h b/net/clients.h
+diff --git a/hw/virtio/vhost-iova-tree.c b/hw/virtio/vhost-iova-tree.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/clients.h
 +++ b/net/clients.h
@@ -XXX,XX +XXX,XX @@ int net_init_hubport(const Netdev *netdev, const char *name,
  int net_init_socket(const Netdev *netdev, const char *name,
                      NetClientState *peer, Error **errp);
 +int net_init_stream(const Netdev *netdev, const char *name,
 +                    NetClientState *peer, Error **errp);
 +
 +int net_init_dgram(const Netdev *netdev, const char *name,
 +                   NetClientState *peer, Error **errp);
 +
  int net_init_tap(const Netdev *netdev, const char *name,
                   NetClientState *peer, Error **errp);
 diff --git a/net/dgram.c b/net/dgram.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/net/dgram.c
++++ b/hw/virtio/vhost-iova-tree.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU System Emulator
++ * vhost software live migration iova tree
 + *
-+ * Copyright (c) 2003-2008 Fabrice Bellard
++ * SPDX-FileCopyrightText: Red Hat, Inc. 2021
-+ * Copyright (c) 2022 Red Hat, Inc.
++ * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
++#include "qemu/iova-tree.h"
++#include "vhost-iova-tree.h"
 +
-+#include "net/net.h"
++#define iova_min_addr qemu_real_host_page_size
 +#include "clients.h"
 +#include "monitor/monitor.h"
 +#include "qapi/error.h"
 +#include "qemu/error-report.h"
 +#include "qemu/option.h"
 +#include "qemu/sockets.h"
 +#include "qemu/iov.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/cutils.h"
 +
-+typedef struct NetDgramState {
++/**
-+    NetClientState nc;
++ * VhostIOVATree, able to:
-+    int fd;
++ * - Translate iova address
-+    SocketReadState rs;
++ * - Reverse translate iova address (from translated to iova)
-+    struct sockaddr_in dgram_dst; /* contains destination iff connectionless */
++ * - Allocate IOVA regions for translated range (linear operation)
-+    bool read_poll;               /* waiting to receive data? */
++ */
-+    bool write_poll;              /* waiting to transmit data? */
++struct VhostIOVATree {
-+} NetDgramState;
++    /* First addressable iova address in the device */
 +    uint64_t iova_first;
 +
-+static void net_dgram_send(void *opaque);
++    /* Last addressable iova address in the device */
-+static void net_dgram_writable(void *opaque);
++    uint64_t iova_last;
 +
-+static void net_dgram_update_fd_handler(NetDgramState *s)
++    /* IOVA address to qemu memory maps. */
 +    IOVATree *iova_taddr_map;
 +};
 +
 +/**
 + * Create a new IOVA tree
 + *
 + * Returns the new IOVA tree
 + */
 +VhostIOVATree *vhost_iova_tree_new(hwaddr iova_first, hwaddr iova_last)
 +{
-+    qemu_set_fd_handler(s->fd,
++    VhostIOVATree *tree = g_new(VhostIOVATree, 1);
-+                        s->read_poll ? net_dgram_send : NULL,
++
-+                        s->write_poll ? net_dgram_writable : NULL,
++    /* Some devices do not like 0 addresses */
-+                        s);
++    tree->iova_first = MAX(iova_first, iova_min_addr);
 +    tree->iova_last = iova_last;
 +
 +    tree->iova_taddr_map = iova_tree_new();
 +    return tree;
 +}
 +
-+static void net_dgram_read_poll(NetDgramState *s, bool enable)
++/**
 + * Delete an iova tree
 + */
 +void vhost_iova_tree_delete(VhostIOVATree *iova_tree)
 +{
-+    s->read_poll = enable;
++    iova_tree_destroy(iova_tree->iova_taddr_map);
-+    net_dgram_update_fd_handler(s);
++    g_free(iova_tree);
 +}
 +
-+static void net_dgram_write_poll(NetDgramState *s, bool enable)
++/**
 + * Find the IOVA address stored from a memory address
 + *
 + * @tree: The iova tree
 + * @map: The map with the memory address
 + *
 + * Return the stored mapping, or NULL if not found.
 + */
 +const DMAMap *vhost_iova_tree_find_iova(const VhostIOVATree *tree,
 +                                        const DMAMap *map)
 +{
-+    s->write_poll = enable;
++    return iova_tree_find_iova(tree->iova_taddr_map, map);
 +    net_dgram_update_fd_handler(s);
 +}
 +
-+static void net_dgram_writable(void *opaque)
++/**
 + * Allocate a new mapping
 + *
 + * @tree: The iova tree
 + * @map: The iova map
 + *
 + * Returns:
 + * - IOVA_OK if the map fits in the container
 + * - IOVA_ERR_INVALID if the map does not make sense (like size overflow)
 + * - IOVA_ERR_NOMEM if tree cannot allocate more space.
 + *
 + * It returns assignated iova in map->iova if return value is VHOST_DMA_MAP_OK.
 + */
 +int vhost_iova_tree_map_alloc(VhostIOVATree *tree, DMAMap *map)
 +{
-+    NetDgramState *s = opaque;
++    /* Some vhost devices do not like addr 0. Skip first page */
 +    hwaddr iova_first = tree->iova_first ?: qemu_real_host_page_size;
 +
-+    net_dgram_write_poll(s, false);
++    if (map->translated_addr + map->size < map->translated_addr ||
 +        map->perm == IOMMU_NONE) {
 +        return IOVA_ERR_INVALID;
 +    }
 +
-+    qemu_flush_queued_packets(&s->nc);
++    /* Allocate a node in IOVA address */
 +    return iova_tree_alloc_map(tree->iova_taddr_map, map, iova_first,
 +                               tree->iova_last);
 +}
 +
-+static ssize_t net_dgram_receive(NetClientState *nc,
++/**
-+                                 const uint8_t *buf, size_t size)
++ * Remove existing mappings from iova tree
 + *
 + * @iova_tree: The vhost iova tree
 + * @map: The map to remove
 + */
 +void vhost_iova_tree_remove(VhostIOVATree *iova_tree, const DMAMap *map)
 +{
-+    NetDgramState *s = DO_UPCAST(NetDgramState, nc, nc);
++    iova_tree_remove(iova_tree->iova_taddr_map, map);
 +    ssize_t ret;
 +
 +    do {
 +        if (s->dgram_dst.sin_family != AF_UNIX) {
 +            ret = sendto(s->fd, buf, size, 0,
 +                         (struct sockaddr *)&s->dgram_dst,
 +                         sizeof(s->dgram_dst));
 +        } else {
 +            ret = send(s->fd, buf, size, 0);
 +        }
 +    } while (ret == -1 && errno == EINTR);
 +
 +    if (ret == -1 && errno == EAGAIN) {
 +        net_dgram_write_poll(s, true);
 +        return 0;
 +    }
 +    return ret;
 +}
-+
+diff --git a/hw/virtio/vhost-iova-tree.h b/hw/virtio/vhost-iova-tree.h
 +static void net_dgram_send_completed(NetClientState *nc, ssize_t len)
 +{
 +    NetDgramState *s = DO_UPCAST(NetDgramState, nc, nc);
 +
 +    if (!s->read_poll) {
 +        net_dgram_read_poll(s, true);
 +    }
 +}
 +
 +static void net_dgram_rs_finalize(SocketReadState *rs)
 +{
 +    NetDgramState *s = container_of(rs, NetDgramState, rs);
 +
 +    if (qemu_send_packet_async(&s->nc, rs->buf,
 +                               rs->packet_len,
 +                               net_dgram_send_completed) == 0) {
 +        net_dgram_read_poll(s, false);
 +    }
 +}
 +
 +static void net_dgram_send(void *opaque)
 +{
 +    NetDgramState *s = opaque;
 +    int size;
 +
 +    size = recv(s->fd, s->rs.buf, sizeof(s->rs.buf), 0);
 +    if (size < 0) {
 +        return;
 +    }
 +    if (size == 0) {
 +        /* end of connection */
 +        net_dgram_read_poll(s, false);
 +        net_dgram_write_poll(s, false);
 +        return;
 +    }
 +    if (qemu_send_packet_async(&s->nc, s->rs.buf, size,
 +                               net_dgram_send_completed) == 0) {
 +        net_dgram_read_poll(s, false);
 +    }
 +}
 +
 +static int net_dgram_mcast_create(struct sockaddr_in *mcastaddr,
 +                                  struct in_addr *localaddr,
 +                                  Error **errp)
 +{
 +    struct ip_mreq imr;
 +    int fd;
 +    int val, ret;
 +#ifdef __OpenBSD__
 +    unsigned char loop;
 +#else
 +    int loop;
 +#endif
 +
 +    if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
 +        error_setg(errp, "specified mcastaddr %s (0x%08x) "
 +                   "does not contain a multicast address",
 +                   inet_ntoa(mcastaddr->sin_addr),
 +                   (int)ntohl(mcastaddr->sin_addr.s_addr));
 +        return -1;
 +    }
 +
 +    fd = qemu_socket(PF_INET, SOCK_DGRAM, 0);
 +    if (fd < 0) {
 +        error_setg_errno(errp, errno, "can't create datagram socket");
 +        return -1;
 +    }
 +
 +    /*
 +     * Allow multiple sockets to bind the same multicast ip and port by setting
 +     * SO_REUSEADDR. This is the only situation where SO_REUSEADDR should be set
 +     * on windows. Use socket_set_fast_reuse otherwise as it sets SO_REUSEADDR
 +     * only on posix systems.
 +     */
 +    val = 1;
 +    ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
 +    if (ret < 0) {
 +        error_setg_errno(errp, errno, "can't set socket option SO_REUSEADDR");
 +        goto fail;
 +    }
 +
 +    ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
 +    if (ret < 0) {
 +        error_setg_errno(errp, errno, "can't bind ip=%s to socket",
 +                         inet_ntoa(mcastaddr->sin_addr));
 +        goto fail;
 +    }
 +
 +    /* Add host to multicast group */
 +    imr.imr_multiaddr = mcastaddr->sin_addr;
 +    if (localaddr) {
 +        imr.imr_interface = *localaddr;
 +    } else {
 +        imr.imr_interface.s_addr = htonl(INADDR_ANY);
 +    }
 +
 +    ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
 +                     &imr, sizeof(struct ip_mreq));
 +    if (ret < 0) {
 +        error_setg_errno(errp, errno,
 +                         "can't add socket to multicast group %s",
 +                         inet_ntoa(imr.imr_multiaddr));
 +        goto fail;
 +    }
 +
 +    /* Force mcast msgs to loopback (eg. several QEMUs in same host */
 +    loop = 1;
 +    ret = setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
 +                     &loop, sizeof(loop));
 +    if (ret < 0) {
 +        error_setg_errno(errp, errno,
 +                         "can't force multicast message to loopback");
 +        goto fail;
 +    }
 +
 +    /* If a bind address is given, only send packets from that address */
 +    if (localaddr != NULL) {
 +        ret = setsockopt(fd, IPPROTO_IP, IP_MULTICAST_IF,
 +                         localaddr, sizeof(*localaddr));
 +        if (ret < 0) {
 +            error_setg_errno(errp, errno,
 +                             "can't set the default network send interface");
 +            goto fail;
 +        }
 +    }
 +
 +    qemu_socket_set_nonblock(fd);
 +    return fd;
 +fail:
 +    if (fd >= 0) {
 +        closesocket(fd);
 +    }
 +    return -1;
 +}
 +
 +static void net_dgram_cleanup(NetClientState *nc)
 +{
 +    NetDgramState *s = DO_UPCAST(NetDgramState, nc, nc);
 +    if (s->fd != -1) {
 +        net_dgram_read_poll(s, false);
 +        net_dgram_write_poll(s, false);
 +        close(s->fd);
 +        s->fd = -1;
 +    }
 +}
 +
 +static NetClientInfo net_dgram_socket_info = {
 +    .type = NET_CLIENT_DRIVER_DGRAM,
 +    .size = sizeof(NetDgramState),
 +    .receive = net_dgram_receive,
 +    .cleanup = net_dgram_cleanup,
 +};
 +
 +static NetDgramState *net_dgram_fd_init(NetClientState *peer,
 +                                        const char *model,
 +                                        const char *name,
 +                                        int fd, int is_fd,
 +                                        SocketAddress *mcast,
 +                                        Error **errp)
 +{
 +    struct sockaddr_in saddr;
 +    int newfd;
 +    NetClientState *nc;
 +    NetDgramState *s;
 +    SocketAddress *sa;
 +    SocketAddressType sa_type;
 +
 +    sa = socket_local_address(fd, errp);
 +    if (!sa) {
 +        return NULL;
 +    }
 +    sa_type = sa->type;
 +    qapi_free_SocketAddress(sa);
 +
 +    /*
 +     * fd passed: multicast: "learn" dgram_dst address from bound address and
 +     * save it. Because this may be "shared" socket from a "master" process,
 +     * datagrams would be recv() by ONLY ONE process: we must "clone" this
 +     * dgram socket --jjo
 +     */
 +
 +    if (is_fd && mcast != NULL) {
 +            if (convert_host_port(&saddr, mcast->u.inet.host,
 +                                  mcast->u.inet.port, errp) < 0) {
 +                goto err;
 +            }
 +            /* must be bound */
 +            if (saddr.sin_addr.s_addr == 0) {
 +                error_setg(errp, "can't setup multicast destination address");
 +                goto err;
 +            }
 +            /* clone dgram socket */
 +            newfd = net_dgram_mcast_create(&saddr, NULL, errp);
 +            if (newfd < 0) {
 +                goto err;
 +            }
 +            /* clone newfd to fd, close newfd */
 +            dup2(newfd, fd);
 +            close(newfd);
 +
 +    }
 +
 +    nc = qemu_new_net_client(&net_dgram_socket_info, peer, model, name);
 +
 +    s = DO_UPCAST(NetDgramState, nc, nc);
 +
 +    s->fd = fd;
 +    net_socket_rs_init(&s->rs, net_dgram_rs_finalize, false);
 +    net_dgram_read_poll(s, true);
 +
 +    /* mcast: save bound address as dst */
 +    if (is_fd && mcast != NULL) {
 +        s->dgram_dst = saddr;
 +        qemu_set_info_str(nc, "fd=%d (cloned mcast=%s:%d)", fd,
 +                          inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 +    } else {
 +        if (sa_type == SOCKET_ADDRESS_TYPE_UNIX) {
 +            s->dgram_dst.sin_family = AF_UNIX;
 +        }
 +
 +        qemu_set_info_str(nc, "fd=%d %s", fd, SocketAddressType_str(sa_type));
 +    }
 +
 +    return s;
 +
 +err:
 +    closesocket(fd);
 +    return NULL;
 +}
 +
 +static int net_dgram_mcast_init(NetClientState *peer,
 +                                const char *model,
 +                                const char *name,
 +                                SocketAddress *remote,
 +                                SocketAddress *local,
 +                                Error **errp)
 +{
 +    NetDgramState *s;
 +    int fd, ret;
 +    struct sockaddr_in saddr;
 +
 +    if (remote->type != SOCKET_ADDRESS_TYPE_INET) {
 +        error_setg(errp, "multicast only support inet type");
 +        return -1;
 +    }
 +
 +    if (convert_host_port(&saddr, remote->u.inet.host, remote->u.inet.port,
 +                          errp) < 0) {
 +        return -1;
 +    }
 +
 +    if (!local) {
 +        fd = net_dgram_mcast_create(&saddr, NULL, errp);
 +        if (fd < 0) {
 +            return -1;
 +        }
 +    } else {
 +        switch (local->type) {
 +        case SOCKET_ADDRESS_TYPE_INET: {
 +            struct in_addr localaddr;
 +
 +            if (inet_aton(local->u.inet.host, &localaddr) == 0) {
 +                error_setg(errp, "localaddr '%s' is not a valid IPv4 address",
 +                           local->u.inet.host);
 +                return -1;
 +            }
 +
 +            fd = net_dgram_mcast_create(&saddr, &localaddr, errp);
 +            if (fd < 0) {
 +                return -1;
 +            }
 +            break;
 +        }
 +        case SOCKET_ADDRESS_TYPE_FD:
 +            fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
 +            if (fd == -1) {
 +                return -1;
 +            }
 +            ret = qemu_socket_try_set_nonblock(fd);
 +            if (ret < 0) {
 +                error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
 +                                 name, fd);
 +                return -1;
 +            }
 +            break;
 +        default:
 +            error_setg(errp, "only support inet or fd type for local");
 +            return -1;
 +        }
 +    }
 +
 +    s = net_dgram_fd_init(peer, model, name, fd,
 +                          local->type == SOCKET_ADDRESS_TYPE_FD,
 +                          remote, errp);
 +    if (!s) {
 +        return -1;
 +    }
 +
 +    s->dgram_dst = saddr;
 +
 +    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr.sin_addr),
 +                      ntohs(saddr.sin_port));
 +    return 0;
 +
 +}
 +
 +
 +int net_init_dgram(const Netdev *netdev, const char *name,
 +                   NetClientState *peer, Error **errp)
 +{
 +    NetDgramState *s;
 +    int fd, ret;
 +    struct sockaddr_in raddr_in;
 +    struct sockaddr_in laddr_in;
 +    SocketAddress *remote, *local;
 +
 +    assert(netdev->type == NET_CLIENT_DRIVER_DGRAM);
 +
 +    remote = netdev->u.dgram.remote;
 +    local = netdev->u.dgram.local;
 +
 +    /* detect multicast address */
 +    if (remote && remote->type == SOCKET_ADDRESS_TYPE_INET) {
 +        struct sockaddr_in mcastaddr;
 +
 +        if (convert_host_port(&mcastaddr, remote->u.inet.host,
 +                              remote->u.inet.port, errp) < 0) {
 +            return -1;
 +        }
 +
 +        if (IN_MULTICAST(ntohl(mcastaddr.sin_addr.s_addr))) {
 +            return net_dgram_mcast_init(peer, "dram", name, remote, local,
 +                                           errp);
 +        }
 +    }
 +
 +    /* unicast address */
 +    if (!local) {
 +        error_setg(errp, "dgram requires local= parameter");
 +        return -1;
 +    }
 +
 +    if (remote) {
 +        if (local->type == SOCKET_ADDRESS_TYPE_FD) {
 +            error_setg(errp, "don't set remote with local.fd");
 +            return -1;
 +        }
 +        if (remote->type != local->type) {
 +            error_setg(errp, "remote and local types must be the same");
 +            return -1;
 +        }
 +    } else {
 +        if (local->type != SOCKET_ADDRESS_TYPE_FD) {
 +            error_setg(errp, "type=inet requires remote parameter");
 +            return -1;
 +        }
 +    }
 +
 +    switch (local->type) {
 +    case SOCKET_ADDRESS_TYPE_INET:
 +        if (convert_host_port(&laddr_in, local->u.inet.host, local->u.inet.port,
 +                              errp) < 0) {
 +            return -1;
 +        }
 +
 +        if (convert_host_port(&raddr_in, remote->u.inet.host,
 +                              remote->u.inet.port, errp) < 0) {
 +            return -1;
 +        }
 +
 +        fd = qemu_socket(PF_INET, SOCK_DGRAM, 0);
 +        if (fd < 0) {
 +            error_setg_errno(errp, errno, "can't create datagram socket");
 +            return -1;
 +        }
 +
 +        ret = socket_set_fast_reuse(fd);
 +        if (ret < 0) {
 +            error_setg_errno(errp, errno,
 +                             "can't set socket option SO_REUSEADDR");
 +            closesocket(fd);
 +            return -1;
 +        }
 +        ret = bind(fd, (struct sockaddr *)&laddr_in, sizeof(laddr_in));
 +        if (ret < 0) {
 +            error_setg_errno(errp, errno, "can't bind ip=%s to socket",
 +                             inet_ntoa(laddr_in.sin_addr));
 +            closesocket(fd);
 +            return -1;
 +        }
 +        qemu_socket_set_nonblock(fd);
 +        break;
 +    case SOCKET_ADDRESS_TYPE_FD:
 +        fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
 +        if (fd == -1) {
 +            return -1;
 +        }
 +        ret = qemu_socket_try_set_nonblock(fd);
 +        if (ret < 0) {
 +            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
 +                             name, fd);
 +            return -1;
 +        }
 +        break;
 +    default:
 +        error_setg(errp, "only support inet or fd type for local");
 +        return -1;
 +    }
 +
 +    s = net_dgram_fd_init(peer, "dgram", name, fd, 0, NULL, errp);
 +    if (!s) {
 +        return -1;
 +    }
 +
 +    if (remote) {
 +        s->dgram_dst = raddr_in;
 +    }
 +
 +    switch (local->type) {
 +    case SOCKET_ADDRESS_TYPE_INET:
 +        qemu_set_info_str(&s->nc, "udp=%s:%d/%s:%d",
 +                          inet_ntoa(laddr_in.sin_addr),
 +                          ntohs(laddr_in.sin_port),
 +                          inet_ntoa(raddr_in.sin_addr),
 +                          ntohs(raddr_in.sin_port));
 +        break;
 +    case SOCKET_ADDRESS_TYPE_FD:
 +        qemu_set_info_str(&s->nc, "fd=%d", fd);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    return 0;
 +}
 diff --git a/net/hub.c b/net/hub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/hub.c
 +++ b/net/hub.c
@@ -XXX,XX +XXX,XX @@ void net_hub_check_clients(void)
              case NET_CLIENT_DRIVER_USER:
              case NET_CLIENT_DRIVER_TAP:
              case NET_CLIENT_DRIVER_SOCKET:
 +            case NET_CLIENT_DRIVER_STREAM:
 +            case NET_CLIENT_DRIVER_DGRAM:
              case NET_CLIENT_DRIVER_VDE:
              case NET_CLIENT_DRIVER_VHOST_USER:
                  has_host_dev = 1;
 diff --git a/net/meson.build b/net/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/net/meson.build
 +++ b/net/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(files(
    'net.c',
    'queue.c',
    'socket.c',
 +  'stream.c',
 +  'dgram.c',
    'util.c',
  ))
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/qemu-print.h"
  #include "qemu/main-loop.h"
  #include "qemu/option.h"
 +#include "qemu/keyval.h"
  #include "qapi/error.h"
  #include "qapi/opts-visitor.h"
  #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
  #endif
          [NET_CLIENT_DRIVER_TAP]       = net_init_tap,
          [NET_CLIENT_DRIVER_SOCKET]    = net_init_socket,
 +        [NET_CLIENT_DRIVER_STREAM]    = net_init_stream,
 +        [NET_CLIENT_DRIVER_DGRAM]     = net_init_dgram,
  #ifdef CONFIG_VDE
          [NET_CLIENT_DRIVER_VDE]       = net_init_vde,
  #endif
@@ -XXX,XX +XXX,XX @@ void show_netdevs(void)
      int idx;
      const char *available_netdevs[] = {
          "socket",
 +        "stream",
 +        "dgram",
          "hubport",
          "tap",
  #ifdef CONFIG_SLIRP
@@ -XXX,XX +XXX,XX @@ void net_init_clients(void)
   */
  bool netdev_is_modern(const char *optarg)
  {
 -    return false;
 +    QemuOpts *opts;
 +    bool is_modern;
 +    const char *type;
 +    static QemuOptsList dummy_opts = {
 +        .name = "netdev",
 +        .implied_opt_name = "type",
 +        .head = QTAILQ_HEAD_INITIALIZER(dummy_opts.head),
 +        .desc = { { } },
 +    };
 +
 +    if (optarg[0] == '{') {
 +        /* This is JSON, which means it's modern syntax */
 +        return true;
 +    }
 +
 +    opts = qemu_opts_create(&dummy_opts, NULL, false, &error_abort);
 +    qemu_opts_do_parse(opts, optarg, dummy_opts.implied_opt_name,
 +                       &error_abort);
 +    type = qemu_opt_get(opts, "type");
 +    is_modern = !g_strcmp0(type, "stream") || !g_strcmp0(type, "dgram");
 +
 +    qemu_opts_reset(&dummy_opts);
 +
 +    return is_modern;
  }
  /*
 diff --git a/net/stream.c b/net/stream.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/net/stream.c
++++ b/hw/virtio/vhost-iova-tree.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU System Emulator
++ * vhost software live migration iova tree
 + *
-+ * Copyright (c) 2003-2008 Fabrice Bellard
++ * SPDX-FileCopyrightText: Red Hat, Inc. 2021
-+ * Copyright (c) 2022 Red Hat, Inc.
++ * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
-+#include "qemu/osdep.h"
++#ifndef HW_VIRTIO_VHOST_IOVA_TREE_H
 +#define HW_VIRTIO_VHOST_IOVA_TREE_H
 +
-+#include "net/net.h"
++#include "qemu/iova-tree.h"
-+#include "clients.h"
++#include "exec/memory.h"
 +#include "monitor/monitor.h"
 +#include "qapi/error.h"
 +#include "qemu/error-report.h"
 +#include "qemu/option.h"
 +#include "qemu/sockets.h"
 +#include "qemu/iov.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/cutils.h"
 +
-+typedef struct NetStreamState {
++typedef struct VhostIOVATree VhostIOVATree;
 +    NetClientState nc;
 +    int listen_fd;
 +    int fd;
 +    SocketReadState rs;
 +    unsigned int send_index;      /* number of bytes sent*/
 +    bool read_poll;               /* waiting to receive data? */
 +    bool write_poll;              /* waiting to transmit data? */
 +} NetStreamState;
 +
-+static void net_stream_send(void *opaque);
++VhostIOVATree *vhost_iova_tree_new(uint64_t iova_first, uint64_t iova_last);
-+static void net_stream_accept(void *opaque);
++void vhost_iova_tree_delete(VhostIOVATree *iova_tree);
-+static void net_stream_writable(void *opaque);
++G_DEFINE_AUTOPTR_CLEANUP_FUNC(VhostIOVATree, vhost_iova_tree_delete);
 +
-+static void net_stream_update_fd_handler(NetStreamState *s)
++const DMAMap *vhost_iova_tree_find_iova(const VhostIOVATree *iova_tree,
-+{
++                                        const DMAMap *map);
-+    qemu_set_fd_handler(s->fd,
++int vhost_iova_tree_map_alloc(VhostIOVATree *iova_tree, DMAMap *map);
-+                        s->read_poll ? net_stream_send : NULL,
++void vhost_iova_tree_remove(VhostIOVATree *iova_tree, const DMAMap *map);
 +                        s->write_poll ? net_stream_writable : NULL,
 +                        s);
 +}
 +
-+static void net_stream_read_poll(NetStreamState *s, bool enable)
++#endif
 +{
 +    s->read_poll = enable;
 +    net_stream_update_fd_handler(s);
 +}
 +
 +static void net_stream_write_poll(NetStreamState *s, bool enable)
 +{
 +    s->write_poll = enable;
 +    net_stream_update_fd_handler(s);
 +}
 +
 +static void net_stream_writable(void *opaque)
 +{
 +    NetStreamState *s = opaque;
 +
 +    net_stream_write_poll(s, false);
 +
 +    qemu_flush_queued_packets(&s->nc);
 +}
 +
 +static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
 +                                  size_t size)
 +{
 +    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
 +    uint32_t len = htonl(size);
 +    struct iovec iov[] = {
 +        {
 +            .iov_base = &len,
 +            .iov_len  = sizeof(len),
 +        }, {
 +            .iov_base = (void *)buf,
 +            .iov_len  = size,
 +        },
 +    };
 +    size_t remaining;
 +    ssize_t ret;
 +
 +    remaining = iov_size(iov, 2) - s->send_index;
 +    ret = iov_send(s->fd, iov, 2, s->send_index, remaining);
 +
 +    if (ret == -1 && errno == EAGAIN) {
 +        ret = 0; /* handled further down */
 +    }
 +    if (ret == -1) {
 +        s->send_index = 0;
 +        return -errno;
 +    }
 +    if (ret < (ssize_t)remaining) {
 +        s->send_index += ret;
 +        net_stream_write_poll(s, true);
 +        return 0;
 +    }
 +    s->send_index = 0;
 +    return size;
 +}
 +
 +static void net_stream_send_completed(NetClientState *nc, ssize_t len)
 +{
 +    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
 +
 +    if (!s->read_poll) {
 +        net_stream_read_poll(s, true);
 +    }
 +}
 +
 +static void net_stream_rs_finalize(SocketReadState *rs)
 +{
 +    NetStreamState *s = container_of(rs, NetStreamState, rs);
 +
 +    if (qemu_send_packet_async(&s->nc, rs->buf,
 +                               rs->packet_len,
 +                               net_stream_send_completed) == 0) {
 +        net_stream_read_poll(s, false);
 +    }
 +}
 +
 +static void net_stream_send(void *opaque)
 +{
 +    NetStreamState *s = opaque;
 +    int size;
 +    int ret;
 +    uint8_t buf1[NET_BUFSIZE];
 +    const uint8_t *buf;
 +
 +    size = recv(s->fd, buf1, sizeof(buf1), 0);
 +    if (size < 0) {
 +        if (errno != EWOULDBLOCK) {
 +            goto eoc;
 +        }
 +    } else if (size == 0) {
 +        /* end of connection */
 +    eoc:
 +        net_stream_read_poll(s, false);
 +        net_stream_write_poll(s, false);
 +        if (s->listen_fd != -1) {
 +            qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
 +        }
 +        closesocket(s->fd);
 +
 +        s->fd = -1;
 +        net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
 +        s->nc.link_down = true;
 +        qemu_set_info_str(&s->nc, "");
 +
 +        return;
 +    }
 +    buf = buf1;
 +
 +    ret = net_fill_rstate(&s->rs, buf, size);
 +
 +    if (ret == -1) {
 +        goto eoc;
 +    }
 +}
 +
 +static void net_stream_cleanup(NetClientState *nc)
 +{
 +    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
 +    if (s->fd != -1) {
 +        net_stream_read_poll(s, false);
 +        net_stream_write_poll(s, false);
 +        close(s->fd);
 +        s->fd = -1;
 +    }
 +    if (s->listen_fd != -1) {
 +        qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
 +        closesocket(s->listen_fd);
 +        s->listen_fd = -1;
 +    }
 +}
 +
 +static void net_stream_connect(void *opaque)
 +{
 +    NetStreamState *s = opaque;
 +    net_stream_read_poll(s, true);
 +}
 +
 +static NetClientInfo net_stream_info = {
 +    .type = NET_CLIENT_DRIVER_STREAM,
 +    .size = sizeof(NetStreamState),
 +    .receive = net_stream_receive,
 +    .cleanup = net_stream_cleanup,
 +};
 +
 +static NetStreamState *net_stream_fd_init(NetClientState *peer,
 +                                          const char *model,
 +                                          const char *name,
 +                                          int fd, int is_connected)
 +{
 +    NetClientState *nc;
 +    NetStreamState *s;
 +
 +    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
 +
 +    qemu_set_info_str(nc, "fd=%d", fd);
 +
 +    s = DO_UPCAST(NetStreamState, nc, nc);
 +
 +    s->fd = fd;
 +    s->listen_fd = -1;
 +    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
 +
 +    /* Disable Nagle algorithm on TCP sockets to reduce latency */
 +    socket_set_nodelay(fd);
 +
 +    if (is_connected) {
 +        net_stream_connect(s);
 +    } else {
 +        qemu_set_fd_handler(s->fd, NULL, net_stream_connect, s);
 +    }
 +    return s;
 +}
 +
 +static void net_stream_accept(void *opaque)
 +{
 +    NetStreamState *s = opaque;
 +    struct sockaddr_in saddr;
 +    socklen_t len;
 +    int fd;
 +
 +    for (;;) {
 +        len = sizeof(saddr);
 +        fd = qemu_accept(s->listen_fd, (struct sockaddr *)&saddr, &len);
 +        if (fd < 0 && errno != EINTR) {
 +            return;
 +        } else if (fd >= 0) {
 +            qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
 +            break;
 +        }
 +    }
 +
 +    s->fd = fd;
 +    s->nc.link_down = false;
 +    net_stream_connect(s);
 +    qemu_set_info_str(&s->nc, "connection from %s:%d",
 +                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 +}
 +
 +static int net_stream_server_init(NetClientState *peer,
 +                                  const char *model,
 +                                  const char *name,
 +                                  SocketAddress *addr,
 +                                  Error **errp)
 +{
 +    NetClientState *nc;
 +    NetStreamState *s;
 +    int fd, ret;
 +
 +    switch (addr->type) {
 +    case SOCKET_ADDRESS_TYPE_INET: {
 +        struct sockaddr_in saddr_in;
 +
 +        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
 +                              errp) < 0) {
 +            return -1;
 +        }
 +
 +        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
 +        if (fd < 0) {
 +            error_setg_errno(errp, errno, "can't create stream socket");
 +            return -1;
 +        }
 +        qemu_socket_set_nonblock(fd);
 +
 +        socket_set_fast_reuse(fd);
 +
 +        ret = bind(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
 +        if (ret < 0) {
 +            error_setg_errno(errp, errno, "can't bind ip=%s to socket",
 +                             inet_ntoa(saddr_in.sin_addr));
 +            closesocket(fd);
 +            return -1;
 +        }
 +        break;
 +    }
 +    case SOCKET_ADDRESS_TYPE_FD:
 +        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
 +        if (fd == -1) {
 +            return -1;
 +        }
 +        ret = qemu_socket_try_set_nonblock(fd);
 +        if (ret < 0) {
 +            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
 +                             name, fd);
 +            return -1;
 +        }
 +        break;
 +    default:
 +        error_setg(errp, "only support inet or fd type");
 +        return -1;
 +    }
 +
 +    ret = listen(fd, 0);
 +    if (ret < 0) {
 +        error_setg_errno(errp, errno, "can't listen on socket");
 +        closesocket(fd);
 +        return -1;
 +    }
 +
 +    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
 +    s = DO_UPCAST(NetStreamState, nc, nc);
 +    s->fd = -1;
 +    s->listen_fd = fd;
 +    s->nc.link_down = true;
 +    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
 +
 +    qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
 +    return 0;
 +}
 +
 +static int net_stream_client_init(NetClientState *peer,
 +                                  const char *model,
 +                                  const char *name,
 +                                  SocketAddress *addr,
 +                                  Error **errp)
 +{
 +    NetStreamState *s;
 +    struct sockaddr_in saddr_in;
 +    int fd, connected, ret;
 +
 +    switch (addr->type) {
 +    case SOCKET_ADDRESS_TYPE_INET:
 +        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
 +                              errp) < 0) {
 +            return -1;
 +        }
 +
 +        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
 +        if (fd < 0) {
 +            error_setg_errno(errp, errno, "can't create stream socket");
 +            return -1;
 +        }
 +        qemu_socket_set_nonblock(fd);
 +
 +        connected = 0;
 +        for (;;) {
 +            ret = connect(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
 +            if (ret < 0) {
 +                if (errno == EINTR || errno == EWOULDBLOCK) {
 +                    /* continue */
 +                } else if (errno == EINPROGRESS ||
 +                           errno == EALREADY ||
 +                           errno == EINVAL) {
 +                    break;
 +                } else {
 +                    error_setg_errno(errp, errno, "can't connect socket");
 +                    closesocket(fd);
 +                    return -1;
 +                }
 +            } else {
 +                connected = 1;
 +                break;
 +            }
 +        }
 +        break;
 +    case SOCKET_ADDRESS_TYPE_FD:
 +        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
 +        if (fd == -1) {
 +            return -1;
 +        }
 +        ret = qemu_socket_try_set_nonblock(fd);
 +        if (ret < 0) {
 +            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
 +                             name, fd);
 +            return -1;
 +        }
 +        connected = 1;
 +        break;
 +    default:
 +        error_setg(errp, "only support inet or fd type");
 +        return -1;
 +    }
 +
 +    s = net_stream_fd_init(peer, model, name, fd, connected);
 +
 +    switch (addr->type) {
 +    case SOCKET_ADDRESS_TYPE_INET:
 +        qemu_set_info_str(&s->nc, "connect to %s:%d",
 +                          inet_ntoa(saddr_in.sin_addr),
 +                          ntohs(saddr_in.sin_port));
 +        break;
 +    case SOCKET_ADDRESS_TYPE_FD:
 +        qemu_set_info_str(&s->nc, "connect to fd %d", fd);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    return 0;
 +}
 +
 +int net_init_stream(const Netdev *netdev, const char *name,
 +                    NetClientState *peer, Error **errp)
 +{
 +    const NetdevStreamOptions *sock;
 +
 +    assert(netdev->type == NET_CLIENT_DRIVER_STREAM);
 +    sock = &netdev->u.stream;
 +
 +    if (!sock->has_server || !sock->server) {
 +        return net_stream_client_init(peer, "stream", name, sock->addr, errp);
 +    }
 +    return net_stream_server_init(peer, "stream", name, sock->addr, errp);
 +}
 diff --git a/qapi/net.json b/qapi/net.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
  ##
  { 'include': 'common.json' }
 +{ 'include': 'sockets.json' }
  ##
  # @set_link:
@@ -XXX,XX +XXX,XX @@
    'if': 'CONFIG_VMNET' }
  ##
 +# @NetdevStreamOptions:
 +#
 +# Configuration info for stream socket netdev
 +#
 +# @addr: socket address to listen on (server=true)
 +#        or connect to (server=false)
 +# @server: create server socket (default: false)
 +#
 +# Only SocketAddress types 'inet' and 'fd' are supported.
 +#
 +# Since: 7.2
 +##
 +{ 'struct': 'NetdevStreamOptions',
 +  'data': {
 +    'addr':   'SocketAddress',
 +    '*server': 'bool' } }
 +
 +##
 +# @NetdevDgramOptions:
 +#
 +# Configuration info for datagram socket netdev.
 +#
 +# @remote: remote address
 +# @local: local address
 +#
 +# Only SocketAddress types 'inet' and 'fd' are supported.
 +#
 +# If remote address is present and it's a multicast address, local address
 +# is optional. Otherwise local address is required and remote address is
 +# optional.
 +#
 +# .. table:: Valid parameters combination table
 +#    :widths: auto
 +#
 +#    =============  ========  =====
 +#    remote         local     okay?
 +#    =============  ========  =====
 +#    absent         absent    no
 +#    absent         not fd    no
 +#    absent         fd        yes
 +#    multicast      absent    yes
 +#    multicast      present   yes
 +#    not multicast  absent    no
 +#    not multicast  present   yes
 +#    =============  ========  =====
 +#
 +# Since: 7.2
 +##
 +{ 'struct': 'NetdevDgramOptions',
 +  'data': {
 +    '*local':  'SocketAddress',
 +    '*remote': 'SocketAddress' } }
 +
 +##
  # @NetClientDriver:
  #
  # Available netdev drivers.
@@ -XXX,XX +XXX,XX @@
  #        @vmnet-host since 7.1
  #        @vmnet-shared since 7.1
  #        @vmnet-bridged since 7.1
 +#        @stream since 7.2
 +#        @dgram since 7.2
  ##
  { 'enum': 'NetClientDriver',
 -  'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
 -            'bridge', 'hubport', 'netmap', 'vhost-user', 'vhost-vdpa',
 +  'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'stream',
 +            'dgram', 'vde', 'bridge', 'hubport', 'netmap', 'vhost-user',
 +            'vhost-vdpa',
              { 'name': 'vmnet-host', 'if': 'CONFIG_VMNET' },
              { 'name': 'vmnet-shared', 'if': 'CONFIG_VMNET' },
              { 'name': 'vmnet-bridged', 'if': 'CONFIG_VMNET' }] }
@@ -XXX,XX +XXX,XX @@
  #        'vmnet-host' - since 7.1
  #        'vmnet-shared' - since 7.1
  #        'vmnet-bridged' - since 7.1
 +#        'stream' since 7.2
 +#        'dgram' since 7.2
  ##
  { 'union': 'Netdev',
    'base': { 'id': 'str', 'type': 'NetClientDriver' },
@@ -XXX,XX +XXX,XX @@
      'tap':      'NetdevTapOptions',
      'l2tpv3':   'NetdevL2TPv3Options',
      'socket':   'NetdevSocketOptions',
 +    'stream':   'NetdevStreamOptions',
 +    'dgram':    'NetdevDgramOptions',
      'vde':      'NetdevVdeOptions',
      'bridge':   'NetdevBridgeOptions',
      'hubport':  'NetdevHubPortOptions',
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
      "-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]\n"
      "                configure a network backend to connect to another network\n"
      "                using an UDP tunnel\n"
 +    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port\n"
 +    "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
 +    "                configure a network backend to connect to another network\n"
 +    "                using a socket connection in stream mode.\n"
 +    "-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]\n"
 +    "-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]\n"
 +    "                configure a network backend to connect to a multicast maddr and port\n"
 +    "                use ``local.host=addr`` to specify the host address to send packets from\n"
 +    "-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]\n"
 +    "-netdev dgram,id=str,local.type=fd,local.str=file-descriptor\n"
 +    "                configure a network backend to connect to another network\n"
 +    "                using an UDP tunnel\n"
  #ifdef CONFIG_VDE
      "-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]\n"
      "                configure a network backend to connect to port 'n' of a vde switch\n"
 --
 .7.4

-[PULL 19/26] net: stream: add unix socket
+[PULL V3 12/15] vdpa: Add custom IOTLB translations to SVQ
-From: Laurent Vivier <lvivier@redhat.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Use translations added in VhostIOVATree in SVQ.
-Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
 Only introduce usage here, not allocation and deallocation. As with
 previous patches, we use the dead code paths of shadow_vqs_enabled to
 avoid commiting too many changes at once. These are impossible to take
 at the moment.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com> (QAPI schema)
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/stream.c    | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++---
+ hw/virtio/vhost-shadow-virtqueue.c |  86 +++++++++++++++++++++++---
- qapi/net.json   |   2 +-
+ hw/virtio/vhost-shadow-virtqueue.h |   6 +-
- qemu-options.hx |   1 +
+ hw/virtio/vhost-vdpa.c             | 122 +++++++++++++++++++++++++++++++------
-files changed, 104 insertions(+), 6 deletions(-)
+ include/hw/virtio/vhost-vdpa.h     |   3 +
+files changed, 187 insertions(+), 30 deletions(-)
-diff --git a/net/stream.c b/net/stream.c
 diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/stream.c
+--- a/hw/virtio/vhost-shadow-virtqueue.c
-+++ b/net/stream.c
++++ b/hw/virtio/vhost-shadow-virtqueue.c
-@@ -XXX,XX +XXX,XX @@ static NetStreamState *net_stream_fd_init(NetClientState *peer,
+@@ -XXX,XX +XXX,XX @@ static uint16_t vhost_svq_available_slots(const VhostShadowVirtqueue *svq)
- static void net_stream_accept(void *opaque)
+     return svq->vring.num - (svq->shadow_avail_idx - svq->shadow_used_idx);
  {
      NetStreamState *s = opaque;
 -    struct sockaddr_in saddr;
 +    struct sockaddr_storage saddr;
      socklen_t len;
      int fd;
@@ -XXX,XX +XXX,XX @@ static void net_stream_accept(void *opaque)
      s->fd = fd;
      s->nc.link_down = false;
      net_stream_connect(s);
 -    qemu_set_info_str(&s->nc, "connection from %s:%d",
 -                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 +    switch (saddr.ss_family) {
 +    case AF_INET: {
 +        struct sockaddr_in *saddr_in = (struct sockaddr_in *)&saddr;
 +
 +        qemu_set_info_str(&s->nc, "connection from %s:%d",
 +                          inet_ntoa(saddr_in->sin_addr),
 +                          ntohs(saddr_in->sin_port));
 +        break;
 +    }
 +    case AF_UNIX: {
 +        struct sockaddr_un saddr_un;
 +
 +        len = sizeof(saddr_un);
 +        getsockname(s->listen_fd, (struct sockaddr *)&saddr_un, &len);
 +        qemu_set_info_str(&s->nc, "connect from %s", saddr_un.sun_path);
 +        break;
 +    }
 +    default:
 +        g_assert_not_reached();
 +    }
  }
- static int net_stream_server_init(NetClientState *peer,
+-static void vhost_vring_write_descs(VhostShadowVirtqueue *svq,
-@@ -XXX,XX +XXX,XX @@ static int net_stream_server_init(NetClientState *peer,
++/**
 + * Translate addresses between the qemu's virtual address and the SVQ IOVA
 + *
 + * @svq: Shadow VirtQueue
 + * @vaddr: Translated IOVA addresses
 + * @iovec: Source qemu's VA addresses
 + * @num: Length of iovec and minimum length of vaddr
 + */
 +static bool vhost_svq_translate_addr(const VhostShadowVirtqueue *svq,
 +                                     hwaddr *addrs, const struct iovec *iovec,
 +                                     size_t num)
 +{
 +    if (num == 0) {
 +        return true;
 +    }
 +
 +    for (size_t i = 0; i < num; ++i) {
 +        DMAMap needle = {
 +            .translated_addr = (hwaddr)(uintptr_t)iovec[i].iov_base,
 +            .size = iovec[i].iov_len,
 +        };
 +        Int128 needle_last, map_last;
 +        size_t off;
 +
 +        const DMAMap *map = vhost_iova_tree_find_iova(svq->iova_tree, &needle);
 +        /*
 +         * Map cannot be NULL since iova map contains all guest space and
 +         * qemu already has a physical address mapped
 +         */
 +        if (unlikely(!map)) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "Invalid address 0x%"HWADDR_PRIx" given by guest",
 +                          needle.translated_addr);
 +            return false;
 +        }
 +
 +        off = needle.translated_addr - map->translated_addr;
 +        addrs[i] = map->iova + off;
 +
 +        needle_last = int128_add(int128_make64(needle.translated_addr),
 +                                 int128_make64(iovec[i].iov_len));
 +        map_last = int128_make64(map->translated_addr + map->size);
 +        if (unlikely(int128_gt(needle_last, map_last))) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "Guest buffer expands over iova range");
 +            return false;
 +        }
 +    }
 +
 +    return true;
 +}
 +
 +static void vhost_vring_write_descs(VhostShadowVirtqueue *svq, hwaddr *sg,
                                      const struct iovec *iovec, size_t num,
                                      bool more_descs, bool write)
  {
@@ -XXX,XX +XXX,XX @@ static void vhost_vring_write_descs(VhostShadowVirtqueue *svq,
          } else {
              descs[i].flags = flags;
          }
-         break;
+-        descs[i].addr = cpu_to_le64((hwaddr)(intptr_t)iovec[n].iov_base);
 +        descs[i].addr = cpu_to_le64(sg[n]);
          descs[i].len = cpu_to_le32(iovec[n].iov_len);
          last = i;
@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
  {
      unsigned avail_idx;
      vring_avail_t *avail = svq->vring.avail;
 +    bool ok;
 +    g_autofree hwaddr *sgs = g_new(hwaddr, MAX(elem->out_num, elem->in_num));
      *head = svq->free_head;
@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
          return false;
      }
-+    case SOCKET_ADDRESS_TYPE_UNIX: {
-+        struct sockaddr_un saddr_un;
+-    vhost_vring_write_descs(svq, elem->out_sg, elem->out_num, elem->in_num > 0,
-+
+-                            false);
-+        ret = unlink(addr->u.q_unix.path);
+-    vhost_vring_write_descs(svq, elem->in_sg, elem->in_num, false, true);
-+        if (ret < 0 && errno != ENOENT) {
++    ok = vhost_svq_translate_addr(svq, sgs, elem->out_sg, elem->out_num);
-+            error_setg_errno(errp, errno, "failed to unlink socket %s",
++    if (unlikely(!ok)) {
-+                             addr->u.q_unix.path);
++        return false;
-+            return -1;
++    }
 +    vhost_vring_write_descs(svq, sgs, elem->out_sg, elem->out_num,
 +                            elem->in_num > 0, false);
 +
 +
 +    ok = vhost_svq_translate_addr(svq, sgs, elem->in_sg, elem->in_num);
 +    if (unlikely(!ok)) {
 +        return false;
 +    }
 +
 +    vhost_vring_write_descs(svq, sgs, elem->in_sg, elem->in_num, false, true);
      /*
       * Put the entry in the available array (but don't update avail->idx until
@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd)
  void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
                                struct vhost_vring_addr *addr)
  {
 -    addr->desc_user_addr = (uint64_t)(intptr_t)svq->vring.desc;
 -    addr->avail_user_addr = (uint64_t)(intptr_t)svq->vring.avail;
 -    addr->used_user_addr = (uint64_t)(intptr_t)svq->vring.used;
 +    addr->desc_user_addr = (uint64_t)(uintptr_t)svq->vring.desc;
 +    addr->avail_user_addr = (uint64_t)(uintptr_t)svq->vring.avail;
 +    addr->used_user_addr = (uint64_t)(uintptr_t)svq->vring.used;
  }
  size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq)
@@ -XXX,XX +XXX,XX @@ void vhost_svq_stop(VhostShadowVirtqueue *svq)
   * Creates vhost shadow virtqueue, and instructs the vhost device to use the
   * shadow methods and file descriptors.
   *
 + * @iova_tree: Tree to perform descriptors translations
 + *
   * Returns the new virtqueue or NULL.
   *
   * In case of error, reason is reported through error_report.
   */
 -VhostShadowVirtqueue *vhost_svq_new(void)
 +VhostShadowVirtqueue *vhost_svq_new(VhostIOVATree *iova_tree)
  {
      g_autofree VhostShadowVirtqueue *svq = g_new0(VhostShadowVirtqueue, 1);
      int r;
@@ -XXX,XX +XXX,XX @@ VhostShadowVirtqueue *vhost_svq_new(void)
      event_notifier_init_fd(&svq->svq_kick, VHOST_FILE_UNBIND);
      event_notifier_set_handler(&svq->hdev_call, vhost_svq_handle_call);
 +    svq->iova_tree = iova_tree;
      return g_steal_pointer(&svq);
  err_init_hdev_call:
 diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-shadow-virtqueue.h
 +++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@
  #include "qemu/event_notifier.h"
  #include "hw/virtio/virtio.h"
  #include "standard-headers/linux/vhost_types.h"
 +#include "hw/virtio/vhost-iova-tree.h"
  /* Shadow virtqueue to relay notifications */
  typedef struct VhostShadowVirtqueue {
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
      /* Virtio device */
      VirtIODevice *vdev;
 +    /* IOVA mapping */
 +    VhostIOVATree *iova_tree;
 +
      /* Map for use the guest's descriptors */
      VirtQueueElement **ring_id_maps;
@@ -XXX,XX +XXX,XX @@ void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
                       VirtQueue *vq);
  void vhost_svq_stop(VhostShadowVirtqueue *svq);
 -VhostShadowVirtqueue *vhost_svq_new(void);
 +VhostShadowVirtqueue *vhost_svq_new(VhostIOVATree *iova_tree);
  void vhost_svq_free(gpointer vq);
  G_DEFINE_AUTOPTR_CLEANUP_FUNC(VhostShadowVirtqueue, vhost_svq_free);
 diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/virtio/vhost-vdpa.c
 +++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static void vhost_vdpa_listener_region_add(MemoryListener *listener,
                                           vaddr, section->readonly);
      llsize = int128_sub(llend, int128_make64(iova));
 +    if (v->shadow_vqs_enabled) {
 +        DMAMap mem_region = {
 +            .translated_addr = (hwaddr)(uintptr_t)vaddr,
 +            .size = int128_get64(llsize) - 1,
 +            .perm = IOMMU_ACCESS_FLAG(true, section->readonly),
 +        };
 +
 +        int r = vhost_iova_tree_map_alloc(v->iova_tree, &mem_region);
 +        if (unlikely(r != IOVA_OK)) {
 +            error_report("Can't allocate a mapping (%d)", r);
 +            goto fail;
 +        }
 +
-+        saddr_un.sun_family = PF_UNIX;
++        iova = mem_region.iova;
-+        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
++    }
-+                       addr->u.q_unix.path);
-+        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
+     vhost_vdpa_iotlb_batch_begin_once(v);
-+            error_setg(errp, "UNIX socket path '%s' is too long",
+     ret = vhost_vdpa_dma_map(v, iova, int128_get64(llsize),
-+                       addr->u.q_unix.path);
+@@ -XXX,XX +XXX,XX @@ static void vhost_vdpa_listener_region_del(MemoryListener *listener,
-+            error_append_hint(errp, "Path must be less than %zu bytes\n",
-+                              sizeof(saddr_un.sun_path));
+     llsize = int128_sub(llend, int128_make64(iova));
-+            return -1;
-+        }
++    if (v->shadow_vqs_enabled) {
-+
++        const DMAMap *result;
-+        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
++        const void *vaddr = memory_region_get_ram_ptr(section->mr) +
-+        if (fd < 0) {
++            section->offset_within_region +
-+            error_setg_errno(errp, errno, "can't create stream socket");
++            (iova - section->offset_within_address_space);
-+            return -1;
++        DMAMap mem_region = {
-+        }
++            .translated_addr = (hwaddr)(uintptr_t)vaddr,
-+        qemu_socket_set_nonblock(fd);
++            .size = int128_get64(llsize) - 1,
-+
++        };
-+        ret = bind(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
++
-+        if (ret < 0) {
++        result = vhost_iova_tree_find_iova(v->iova_tree, &mem_region);
-+            error_setg_errno(errp, errno, "can't create socket with path: %s",
++        iova = result->iova;
-+                             saddr_un.sun_path);
++        vhost_iova_tree_remove(v->iova_tree, &mem_region);
-+            closesocket(fd);
++    }
-+            return -1;
+     vhost_vdpa_iotlb_batch_begin_once(v);
-+        }
+     ret = vhost_vdpa_dma_unmap(v, iova, int128_get64(llsize));
-+        break;
+     if (ret) {
-+    }
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
-     case SOCKET_ADDRESS_TYPE_FD:
-         fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
+     shadow_vqs = g_ptr_array_new_full(hdev->nvqs, vhost_svq_free);
-         if (fd == -1) {
+     for (unsigned n = 0; n < hdev->nvqs; ++n) {
-@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
+-        g_autoptr(VhostShadowVirtqueue) svq = vhost_svq_new();
- {
++        g_autoptr(VhostShadowVirtqueue) svq = vhost_svq_new(v->iova_tree);
-     NetStreamState *s;
-     struct sockaddr_in saddr_in;
+         if (unlikely(!svq)) {
-+    struct sockaddr_un saddr_un;
+             error_setg(errp, "Cannot create svq %u", n);
-     int fd, connected, ret;
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_svq_set_fds(struct vhost_dev *dev,
+ /**
-     switch (addr->type) {
+  * Unmap a SVQ area in the device
-@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
+  */
-             }
+-static bool vhost_vdpa_svq_unmap_ring(struct vhost_vdpa *v, hwaddr iova,
-         }
+-                                      hwaddr size)
-         break;
++static bool vhost_vdpa_svq_unmap_ring(struct vhost_vdpa *v,
-+    case SOCKET_ADDRESS_TYPE_UNIX:
++                                      const DMAMap *needle)
-+        saddr_un.sun_family = PF_UNIX;
+ {
-+        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
++    const DMAMap *result = vhost_iova_tree_find_iova(v->iova_tree, needle);
-+                       addr->u.q_unix.path);
++    hwaddr size;
-+        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
+     int r;
-+            error_setg(errp, "UNIX socket path '%s' is too long",
-+                       addr->u.q_unix.path);
+-    size = ROUND_UP(size, qemu_real_host_page_size);
-+            error_append_hint(errp, "Path must be less than %zu bytes\n",
+-    r = vhost_vdpa_dma_unmap(v, iova, size);
-+                              sizeof(saddr_un.sun_path));
++    if (unlikely(!result)) {
-+            return -1;
++        error_report("Unable to find SVQ address to unmap");
-+        }
++        return false;
-+
++    }
-+        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
++
-+        if (fd < 0) {
++    size = ROUND_UP(result->size, qemu_real_host_page_size);
-+            error_setg_errno(errp, errno, "can't create stream socket");
++    r = vhost_vdpa_dma_unmap(v, result->iova, size);
-+            return -1;
+     return r == 0;
-+        }
+ }
-+        qemu_socket_set_nonblock(fd);
-+
+ static bool vhost_vdpa_svq_unmap_rings(struct vhost_dev *dev,
-+        connected = 0;
+                                        const VhostShadowVirtqueue *svq)
-+        for (;;) {
+ {
-+            ret = connect(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
++    DMAMap needle = {};
-+            if (ret < 0) {
+     struct vhost_vdpa *v = dev->opaque;
-+                if (errno == EINTR || errno == EWOULDBLOCK) {
+     struct vhost_vring_addr svq_addr;
-+                    /* continue */
+-    size_t device_size = vhost_svq_device_area_size(svq);
-+                } else if (errno == EAGAIN ||
+-    size_t driver_size = vhost_svq_driver_area_size(svq);
-+                           errno == EALREADY) {
+     bool ok;
-+                    break;
-+                } else {
+     vhost_svq_get_vring_addr(svq, &svq_addr);
-+                    error_setg_errno(errp, errno, "can't connect socket");
-+                    closesocket(fd);
+-    ok = vhost_vdpa_svq_unmap_ring(v, svq_addr.desc_user_addr, driver_size);
-+                    return -1;
++    needle.translated_addr = svq_addr.desc_user_addr;
-+                }
++    ok = vhost_vdpa_svq_unmap_ring(v, &needle);
-+            } else {
+     if (unlikely(!ok)) {
-+                connected = 1;
+         return false;
 +                break;
 +            }
 +        }
 +        break;
      case SOCKET_ADDRESS_TYPE_FD:
          fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
          if (fd == -1) {
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
          connected = 1;
          break;
      default:
 -        error_setg(errp, "only support inet or fd type");
 +        error_setg(errp, "only support inet, unix or fd type");
          return -1;
      }
-@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
+-    return vhost_vdpa_svq_unmap_ring(v, svq_addr.used_user_addr, device_size);
-                           inet_ntoa(saddr_in.sin_addr),
++    needle.translated_addr = svq_addr.used_user_addr;
-                           ntohs(saddr_in.sin_port));
++    return vhost_vdpa_svq_unmap_ring(v, &needle);
-         break;
++}
-+    case SOCKET_ADDRESS_TYPE_UNIX:
++
-+        qemu_set_info_str(&s->nc, " connect to %s", saddr_un.sun_path);
++/**
-+        break;
++ * Map the SVQ area in the device
-     case SOCKET_ADDRESS_TYPE_FD:
++ *
-         qemu_set_info_str(&s->nc, "connect to fd %d", fd);
++ * @v: Vhost-vdpa device
-         break;
++ * @needle: The area to search iova
-     default:
++ * @errorp: Error pointer
-         g_assert_not_reached();
++ */
 +static bool vhost_vdpa_svq_map_ring(struct vhost_vdpa *v, DMAMap *needle,
 +                                    Error **errp)
 +{
 +    int r;
 +
 +    r = vhost_iova_tree_map_alloc(v->iova_tree, needle);
 +    if (unlikely(r != IOVA_OK)) {
 +        error_setg(errp, "Cannot allocate iova (%d)", r);
 +        return false;
 +    }
 +
 +    r = vhost_vdpa_dma_map(v, needle->iova, needle->size + 1,
 +                           (void *)(uintptr_t)needle->translated_addr,
 +                           needle->perm == IOMMU_RO);
 +    if (unlikely(r != 0)) {
 +        error_setg_errno(errp, -r, "Cannot map region to device");
 +        vhost_iova_tree_remove(v->iova_tree, needle);
 +    }
 +
 +    return r == 0;
  }
  /**
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_map_rings(struct vhost_dev *dev,
                                       struct vhost_vring_addr *addr,
                                       Error **errp)
  {
 +    DMAMap device_region, driver_region;
 +    struct vhost_vring_addr svq_addr;
      struct vhost_vdpa *v = dev->opaque;
      size_t device_size = vhost_svq_device_area_size(svq);
      size_t driver_size = vhost_svq_driver_area_size(svq);
 -    int r;
 +    size_t avail_offset;
 +    bool ok;
      ERRP_GUARD();
 -    vhost_svq_get_vring_addr(svq, addr);
 +    vhost_svq_get_vring_addr(svq, &svq_addr);
 -    r = vhost_vdpa_dma_map(v, addr->desc_user_addr, driver_size,
 -                           (void *)(uintptr_t)addr->desc_user_addr, true);
 -    if (unlikely(r != 0)) {
 -        error_setg_errno(errp, -r, "Cannot create vq driver region: ");
 +    driver_region = (DMAMap) {
 +        .translated_addr = svq_addr.desc_user_addr,
 +        .size = driver_size - 1,
 +        .perm = IOMMU_RO,
 +    };
 +    ok = vhost_vdpa_svq_map_ring(v, &driver_region, errp);
 +    if (unlikely(!ok)) {
 +        error_prepend(errp, "Cannot create vq driver region: ");
          return false;
      }
--
++    addr->desc_user_addr = driver_region.iova;
-     return 0;
++    avail_offset = svq_addr.avail_user_addr - svq_addr.desc_user_addr;
 +    addr->avail_user_addr = driver_region.iova + avail_offset;
 -    r = vhost_vdpa_dma_map(v, addr->used_user_addr, device_size,
 -                           (void *)(intptr_t)addr->used_user_addr, false);
 -    if (unlikely(r != 0)) {
 -        error_setg_errno(errp, -r, "Cannot create vq device region: ");
 +    device_region = (DMAMap) {
 +        .translated_addr = svq_addr.used_user_addr,
 +        .size = device_size - 1,
 +        .perm = IOMMU_RW,
 +    };
 +    ok = vhost_vdpa_svq_map_ring(v, &device_region, errp);
 +    if (unlikely(!ok)) {
 +        error_prepend(errp, "Cannot create vq device region: ");
 +        vhost_vdpa_svq_unmap_ring(v, &driver_region);
      }
 +    addr->used_user_addr = device_region.iova;
 -    return r == 0;
 +    return ok;
  }
-diff --git a/qapi/net.json b/qapi/net.json
+ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
 diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
 index XXXXXXX..XXXXXXX 100644
---- a/qapi/net.json
+--- a/include/hw/virtio/vhost-vdpa.h
-+++ b/qapi/net.json
++++ b/include/hw/virtio/vhost-vdpa.h
 @@ -XXX,XX +XXX,XX @@
- #        or connect to (server=false)
- # @server: create server socket (default: false)
+ #include <gmodule.h>
- #
--# Only SocketAddress types 'inet' and 'fd' are supported.
++#include "hw/virtio/vhost-iova-tree.h"
-+# Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
+ #include "hw/virtio/virtio.h"
- #
+ #include "standard-headers/linux/vhost_types.h"
- # Since: 7.2
- ##
+@@ -XXX,XX +XXX,XX @@ typedef struct vhost_vdpa {
-diff --git a/qemu-options.hx b/qemu-options.hx
+     MemoryListener listener;
-index XXXXXXX..XXXXXXX 100644
+     struct vhost_vdpa_iova_range iova_range;
---- a/qemu-options.hx
+     bool shadow_vqs_enabled;
-+++ b/qemu-options.hx
++    /* IOVA mapping used by the Shadow Virtqueue */
-@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
++    VhostIOVATree *iova_tree;
-     "                configure a network backend to connect to another network\n"
+     GPtrArray *shadow_vqs;
-     "                using an UDP tunnel\n"
+     struct vhost_dev *dev;
-     "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port\n"
+     VhostVDPAHostNotifier notifier[VIRTIO_QUEUE_MAX];
 +    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path\n"
      "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
      "                configure a network backend to connect to another network\n"
      "                using a socket connection in stream mode.\n"
 --
 .7.4

-[PULL 03/26] vdpa: Delete duplicated vdpa_feature_bits entry
+[PULL V3 13/15] vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
 From: Eugenio Pérez <eperezma@redhat.com>
-This entry was duplicated on referenced commit. Removing it.
+This is needed to achieve migration, so the destination can restore its
 index.
-Fixes: 402378407dbd ("vhost-vdpa: multiqueue support")
+Setting base as last used idx, so destination will see as available all
 the entries that the device did not use, including the in-flight
 processing ones.
 This is ok for networking, but other kinds of devices might have
 problems with these retransmissions.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
-Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/vhost-vdpa.c | 1 -
+ hw/virtio/vhost-vdpa.c | 17 +++++++++++++++++
-file changed, 1 deletion(-)
+file changed, 17 insertions(+)
-diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
+diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/vhost-vdpa.c
+--- a/hw/virtio/vhost-vdpa.c
-+++ b/net/vhost-vdpa.c
++++ b/hw/virtio/vhost-vdpa.c
-@@ -XXX,XX +XXX,XX @@ const int vdpa_feature_bits[] = {
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_base(struct vhost_dev *dev,
-     VIRTIO_NET_F_CTRL_RX,
+ static int vhost_vdpa_get_vring_base(struct vhost_dev *dev,
-     VIRTIO_NET_F_CTRL_RX_EXTRA,
+                                        struct vhost_vring_state *ring)
-     VIRTIO_NET_F_CTRL_VLAN,
+ {
--    VIRTIO_NET_F_GUEST_ANNOUNCE,
++    struct vhost_vdpa *v = dev->opaque;
-     VIRTIO_NET_F_CTRL_MAC_ADDR,
+     int ret;
-     VIRTIO_NET_F_RSS,
-     VIRTIO_NET_F_MQ,
++    if (v->shadow_vqs_enabled) {
 +        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs,
 +                                                      ring->index);
 +
 +        /*
 +         * Setting base as last used idx, so destination will see as available
 +         * all the entries that the device did not use, including the in-flight
 +         * processing ones.
 +         *
 +         * TODO: This is ok for networking, but other kinds of devices might
 +         * have problems with these retransmissions.
 +         */
 +        ring->num = svq->last_used_idx;
 +        return 0;
 +    }
 +
      ret = vhost_vdpa_call(dev, VHOST_GET_VRING_BASE, ring);
      trace_vhost_vdpa_get_vring_base(dev, ring->index, ring->num);
      return ret;
 --
 .7.4

-[PULL 06/26] net: improve error message for missing netdev backend
+[PULL V3 14/15] vdpa: Never set log_base addr if SVQ is enabled
-From: Daniel P. Berrangé <berrange@redhat.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-The current message when using '-net user...' with SLIRP disabled at
+Setting the log address would make the device start reporting invalid
-compile time is:
+dirty memory because the SVQ vrings are located in qemu's memory.
-  qemu-system-x86_64: -net user: Parameter 'type' expects a net backend type (maybe it is not compiled into this binary)
+Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
 An observation is that we're using the 'netdev->type' field here which
 is an enum value, produced after QAPI has converted from its string
 form.
 IOW, at this point in the code, we know that the user's specified
 type name was a valid network backend. The only possible scenario that
 can make the backend init function be NULL, is if support for that
 backend was disabled at build time. Given this, we don't need to caveat
 our error message with a 'maybe' hint, we can be totally explicit.
 The use of QERR_INVALID_PARAMETER_VALUE doesn't really lend itself to
 user friendly error message text. Since this is not used to set a
 specific QAPI error class, we can simply stop using this pre-formatted
 error text and provide something better.
 Thus the new message is:
   qemu-system-x86_64: -net user: network backend 'user' is not compiled into this binary
 The case of passing 'hubport' for -net is also given a message reminding
 people they should have used -netdev/-nic instead, as this backend type
 is only valid for the modern syntax.
 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/net.c | 18 +++++++++++-------
+ hw/virtio/vhost-vdpa.c | 3 ++-
-file changed, 11 insertions(+), 7 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/net/net.c b/net/net.c
+diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
+--- a/hw/virtio/vhost-vdpa.c
-+++ b/net/net.c
++++ b/hw/virtio/vhost-vdpa.c
-@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
-     if (is_netdev) {
+ static int vhost_vdpa_set_log_base(struct vhost_dev *dev, uint64_t base,
-         if (netdev->type == NET_CLIENT_DRIVER_NIC ||
+                                      struct vhost_log *log)
-             !net_client_init_fun[netdev->type]) {
+ {
--            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
+-    if (vhost_vdpa_one_time_request(dev)) {
--                       "a netdev backend type");
++    struct vhost_vdpa *v = dev->opaque;
-+            error_setg(errp, "network backend '%s' is not compiled into this binary",
++    if (v->shadow_vqs_enabled || vhost_vdpa_one_time_request(dev)) {
-+                       NetClientDriver_str(netdev->type));
+         return 0;
-             return -1;
+     }
          }
      } else {
          if (netdev->type == NET_CLIENT_DRIVER_NONE) {
              return 0; /* nothing to do */
          }
 -        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT ||
 -            !net_client_init_fun[netdev->type]) {
 -            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
 -                       "a net backend type (maybe it is not compiled "
 -                       "into this binary)");
 +        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT) {
 +            error_setg(errp, "network backend '%s' is only supported with -netdev/-nic",
 +                       NetClientDriver_str(netdev->type));
 +            return -1;
 +        }
 +
 +        if (!net_client_init_fun[netdev->type]) {
 +            error_setg(errp, "network backend '%s' is not compiled into this binary",
 +                       NetClientDriver_str(netdev->type));
              return -1;
          }
 --
 .7.4

-[PULL 05/26] vhost-vdpa: allow passing opened vhostfd to vhost-vdpa
+[PULL V3 15/15] vdpa: Expose VHOST_F_LOG_ALL on SVQ
-From: Si-Wei Liu <si-wei.liu@oracle.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-Similar to other vhost backends, vhostfd can be passed to vhost-vdpa
+SVQ is able to log the dirty bits by itself, so let's use it to not
-backend as another parameter to instantiate vhost-vdpa net client.
+block migration.
 This would benefit the use case where only open file descriptors, as
 opposed to raw vhost-vdpa device paths, are accessible from the QEMU
 process.
-(qemu) netdev_add type=vhost-vdpa,vhostfd=61,id=vhost-vdpa1
+Also, ignore set and clear of VHOST_F_LOG_ALL on set_features if SVQ is
 enabled. Even if the device supports it, the reports would be nonsense
 because SVQ memory is in the qemu region.
-Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
+The log region is still allocated. Future changes might skip that, but
-Acked-by: Eugenio Pérez <eperezma@redhat.com>
+this series is already long enough.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/vhost-vdpa.c | 25 ++++++++++++++++++++-----
+ hw/virtio/vhost-vdpa.c         | 39 +++++++++++++++++++++++++++++++++++----
- qapi/net.json    |  3 +++
+ include/hw/virtio/vhost-vdpa.h |  1 +
- qemu-options.hx  |  6 ++++--
+files changed, 36 insertions(+), 4 deletions(-)
 files changed, 27 insertions(+), 7 deletions(-)
-diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
+diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/vhost-vdpa.c
+--- a/hw/virtio/vhost-vdpa.c
-+++ b/net/vhost-vdpa.c
++++ b/hw/virtio/vhost-vdpa.c
-@@ -XXX,XX +XXX,XX @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
+@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_one_time_request(struct vhost_dev *dev)
+     return v->index != 0;
-     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
+ }
-     opts = &netdev->u.vhost_vdpa;
--    if (!opts->vhostdev) {
++static int vhost_vdpa_get_dev_features(struct vhost_dev *dev,
--        error_setg(errp, "vdpa character device not specified with vhostdev");
++                                       uint64_t *features)
-+    if (!opts->has_vhostdev && !opts->has_vhostfd) {
++{
-+        error_setg(errp,
++    int ret;
-+                   "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
++
-         return -1;
++    ret = vhost_vdpa_call(dev, VHOST_GET_FEATURES, features);
 +    trace_vhost_vdpa_get_features(dev, *features);
 +    return ret;
 +}
 +
  static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
                                 Error **errp)
  {
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
          return 0;
      }
--    vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
+-    r = hdev->vhost_ops->vhost_get_features(hdev, &dev_features);
--    if (vdpa_device_fd == -1) {
++    r = vhost_vdpa_get_dev_features(hdev, &dev_features);
--        return -errno;
+     if (r != 0) {
-+    if (opts->has_vhostdev && opts->has_vhostfd) {
+         error_setg_errno(errp, -r, "Can't get vdpa device features");
-+        error_setg(errp,
+         return r;
-+                   "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_mem_table(struct vhost_dev *dev,
-+        return -1;
+ static int vhost_vdpa_set_features(struct vhost_dev *dev,
                                     uint64_t features)
  {
 +    struct vhost_vdpa *v = dev->opaque;
      int ret;
      if (vhost_vdpa_one_time_request(dev)) {
          return 0;
      }
 +    if (v->shadow_vqs_enabled) {
 +        if ((v->acked_features ^ features) == BIT_ULL(VHOST_F_LOG_ALL)) {
 +            /*
 +             * QEMU is just trying to enable or disable logging. SVQ handles
 +             * this sepparately, so no need to forward this.
 +             */
 +            v->acked_features = features;
 +            return 0;
 +        }
 +
 +        v->acked_features = features;
 +
 +        /* We must not ack _F_LOG if SVQ is enabled */
 +        features &= ~BIT_ULL(VHOST_F_LOG_ALL);
 +    }
 +
-+    if (opts->has_vhostdev) {
+     trace_vhost_vdpa_set_features(dev, features);
-+        vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
+     ret = vhost_vdpa_call(dev, VHOST_SET_FEATURES, &features);
-+        if (vdpa_device_fd == -1) {
+     if (ret) {
-+            return -errno;
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_call(struct vhost_dev *dev,
-+        }
+ static int vhost_vdpa_get_features(struct vhost_dev *dev,
-+    } else if (opts->has_vhostfd) {
+                                      uint64_t *features)
-+        vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
+ {
-+        if (vdpa_device_fd == -1) {
+-    int ret;
-+            error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
++    struct vhost_vdpa *v = dev->opaque;
-+            return -1;
++    int ret = vhost_vdpa_get_dev_features(dev, features);
-+        }
++
-     }
++    if (ret == 0 && v->shadow_vqs_enabled) {
++        /* Add SVQ logging capabilities */
-     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
++        *features |= BIT_ULL(VHOST_F_LOG_ALL);
-diff --git a/qapi/net.json b/qapi/net.json
++    }
 -    ret = vhost_vdpa_call(dev, VHOST_GET_FEATURES, features);
 -    trace_vhost_vdpa_get_features(dev, *features);
      return ret;
  }
 diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
 index XXXXXXX..XXXXXXX 100644
---- a/qapi/net.json
+--- a/include/hw/virtio/vhost-vdpa.h
-+++ b/qapi/net.json
++++ b/include/hw/virtio/vhost-vdpa.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct vhost_vdpa {
- # @vhostdev: path of vhost-vdpa device
+     bool iotlb_batch_begin_sent;
- #            (default:'/dev/vhost-vdpa-0')
+     MemoryListener listener;
- #
+     struct vhost_vdpa_iova_range iova_range;
-+# @vhostfd: file descriptor of an already opened vhost vdpa device
++    uint64_t acked_features;
-+#
+     bool shadow_vqs_enabled;
- # @queues: number of queues to be created for multiqueue vhost-vdpa
+     /* IOVA mapping used by the Shadow Virtqueue */
- #          (default: 1)
+     VhostIOVATree *iova_tree;
  #
@@ -XXX,XX +XXX,XX @@
  { 'struct': 'NetdevVhostVDPAOptions',
    'data': {
      '*vhostdev':     'str',
 +    '*vhostfd':      'str',
      '*queues':       'int',
      '*x-svq':        {'type': 'bool', 'features' : [ 'unstable'] } } }
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
      "                configure a vhost-user network, backed by a chardev 'dev'\n"
  #endif
  #ifdef __linux__
 -    "-netdev vhost-vdpa,id=str,vhostdev=/path/to/dev\n"
 +    "-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]\n"
      "                configure a vhost-vdpa network,Establish a vhost-vdpa netdev\n"
 +    "                use 'vhostdev=/path/to/dev' to open a vhost vdpa device\n"
 +    "                use 'vhostfd=h' to connect to an already opened vhost vdpa device\n"
  #endif
  #ifdef CONFIG_VMNET
      "-netdev vmnet-host,id=str[,isolated=on|off][,net-uuid=uuid]\n"
@@ -XXX,XX +XXX,XX @@ SRST
               -netdev type=vhost-user,id=net0,chardev=chr0 \
               -device virtio-net-pci,netdev=net0
 -``-netdev vhost-vdpa,vhostdev=/path/to/dev``
 +``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
      Establish a vhost-vdpa netdev.
      vDPA device is a device that uses a datapath which complies with
 --
 .7.4

-[PULL 11/26] net: introduce convert_host_port()
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- include/qemu/sockets.h |  2 ++
- net/net.c              | 62 ++++++++++++++++++++++++++------------------------
-files changed, 34 insertions(+), 30 deletions(-)
-diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/sockets.h
-+++ b/include/qemu/sockets.h
-@@ -XXX,XX +XXX,XX @@ void socket_listen_cleanup(int fd, Error **errp);
- int socket_dgram(SocketAddress *remote, SocketAddress *local, Error **errp);
- /* Old, ipv4 only bits.  Don't use for new code. */
-+int convert_host_port(struct sockaddr_in *saddr, const char *host,
-+                      const char *port, Error **errp);
- int parse_host_port(struct sockaddr_in *saddr, const char *str,
-                     Error **errp);
- int socket_init(void);
-diff --git a/net/net.c b/net/net.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
-+++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ static QTAILQ_HEAD(, NetClientState) net_clients;
- /***********************************************************/
- /* network device redirectors */
--int parse_host_port(struct sockaddr_in *saddr, const char *str,
--                    Error **errp)
-+int convert_host_port(struct sockaddr_in *saddr, const char *host,
-+                      const char *port, Error **errp)
- {
--    gchar **substrings;
-     struct hostent *he;
--    const char *addr, *p, *r;
--    int port, ret = 0;
-+    const char *r;
-+    long p;
-     memset(saddr, 0, sizeof(*saddr));
--    substrings = g_strsplit(str, ":", 2);
--    if (!substrings || !substrings[0] || !substrings[1]) {
--        error_setg(errp, "host address '%s' doesn't contain ':' "
--                   "separating host from port", str);
--        ret = -1;
--        goto out;
--    }
--
--    addr = substrings[0];
--    p = substrings[1];
--
-     saddr->sin_family = AF_INET;
--    if (addr[0] == '\0') {
-+    if (host[0] == '\0') {
-         saddr->sin_addr.s_addr = 0;
-     } else {
--        if (qemu_isdigit(addr[0])) {
--            if (!inet_aton(addr, &saddr->sin_addr)) {
-+        if (qemu_isdigit(host[0])) {
-+            if (!inet_aton(host, &saddr->sin_addr)) {
-                 error_setg(errp, "host address '%s' is not a valid "
--                           "IPv4 address", addr);
--                ret = -1;
--                goto out;
-+                           "IPv4 address", host);
-+                return -1;
-             }
-         } else {
--            he = gethostbyname(addr);
-+            he = gethostbyname(host);
-             if (he == NULL) {
--                error_setg(errp, "can't resolve host address '%s'", addr);
--                ret = -1;
--                goto out;
-+                error_setg(errp, "can't resolve host address '%s'", host);
-+                return -1;
-             }
-             saddr->sin_addr = *(struct in_addr *)he->h_addr;
-         }
-     }
--    port = strtol(p, (char **)&r, 0);
--    if (r == p) {
--        error_setg(errp, "port number '%s' is invalid", p);
-+    if (qemu_strtol(port, &r, 0, &p) != 0) {
-+        error_setg(errp, "port number '%s' is invalid", port);
-+        return -1;
-+    }
-+    saddr->sin_port = htons(p);
-+    return 0;
-+}
-+
-+int parse_host_port(struct sockaddr_in *saddr, const char *str,
-+                    Error **errp)
-+{
-+    gchar **substrings;
-+    int ret;
-+
-+    substrings = g_strsplit(str, ":", 2);
-+    if (!substrings || !substrings[0] || !substrings[1]) {
-+        error_setg(errp, "host address '%s' doesn't contain ':' "
-+                   "separating host from port", str);
-         ret = -1;
-         goto out;
-     }
--    saddr->sin_port = htons(port);
-+
-+    ret = convert_host_port(saddr, substrings[0], substrings[1], errp);
- out:
-     g_strfreev(substrings);
---
-.7.4

-[PULL 12/26] net: remove the @errp argument of net_client_inits()
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-The only caller passes &error_fatal, so use this directly in the function.
-It's what we do for -blockdev, -device, and -object.
-Suggested-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- include/net/net.h |  2 +-
- net/net.c         | 20 +++++++-------------
- softmmu/vl.c      |  2 +-
-files changed, 9 insertions(+), 15 deletions(-)
-diff --git a/include/net/net.h b/include/net/net.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
-+++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
- /* from net.c */
- int net_client_parse(QemuOptsList *opts_list, const char *str);
- void show_netdevs(void);
--int net_init_clients(Error **errp);
-+void net_init_clients(void);
- void net_check_clients(void);
- void net_cleanup(void);
- void hmp_host_net_add(Monitor *mon, const QDict *qdict);
-diff --git a/net/net.c b/net/net.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
-+++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ out:
-     return ret;
- }
--int net_init_clients(Error **errp)
-+void net_init_clients(void)
- {
-     net_change_state_entry =
-         qemu_add_vm_change_state_handler(net_vm_change_state_handler, NULL);
-     QTAILQ_INIT(&net_clients);
--    if (qemu_opts_foreach(qemu_find_opts("netdev"),
--                          net_init_netdev, NULL, errp)) {
--        return -1;
--    }
--
--    if (qemu_opts_foreach(qemu_find_opts("nic"), net_param_nic, NULL, errp)) {
--        return -1;
--    }
-+    qemu_opts_foreach(qemu_find_opts("netdev"), net_init_netdev, NULL,
-+                      &error_fatal);
--    if (qemu_opts_foreach(qemu_find_opts("net"), net_init_client, NULL, errp)) {
--        return -1;
--    }
-+    qemu_opts_foreach(qemu_find_opts("nic"), net_param_nic, NULL,
-+                      &error_fatal);
--    return 0;
-+    qemu_opts_foreach(qemu_find_opts("net"), net_init_client, NULL,
-+                      &error_fatal);
- }
- int net_client_parse(QemuOptsList *opts_list, const char *optarg)
-diff --git a/softmmu/vl.c b/softmmu/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/vl.c
-+++ b/softmmu/vl.c
-@@ -XXX,XX +XXX,XX @@ static void qemu_create_late_backends(void)
-         qtest_server_init(qtest_chrdev, qtest_log, &error_fatal);
-     }
--    net_init_clients(&error_fatal);
-+    net_init_clients();
-     object_option_foreach_add(object_create_late);
---
-.7.4

-[PULL 13/26] net: simplify net_client_parse() error management
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-All net_client_parse() callers exit in case of error.
-Move exit(1) to net_client_parse() and remove error checking from
-the callers.
-Suggested-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- include/net/net.h |  2 +-
- net/net.c         |  6 ++----
- softmmu/vl.c      | 12 +++---------
-files changed, 6 insertions(+), 14 deletions(-)
-diff --git a/include/net/net.h b/include/net/net.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
-+++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ extern NICInfo nd_table[MAX_NICS];
- extern const char *host_net_devices[];
- /* from net.c */
--int net_client_parse(QemuOptsList *opts_list, const char *str);
-+void net_client_parse(QemuOptsList *opts_list, const char *str);
- void show_netdevs(void);
- void net_init_clients(void);
- void net_check_clients(void);
-diff --git a/net/net.c b/net/net.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
-+++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ void net_init_clients(void)
-                       &error_fatal);
- }
--int net_client_parse(QemuOptsList *opts_list, const char *optarg)
-+void net_client_parse(QemuOptsList *opts_list, const char *optarg)
- {
-     if (!qemu_opts_parse_noisily(opts_list, optarg, true)) {
--        return -1;
-+        exit(1);
-     }
--
--    return 0;
- }
- /* From FreeBSD */
-diff --git a/softmmu/vl.c b/softmmu/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/vl.c
-+++ b/softmmu/vl.c
-@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
-                 break;
-             case QEMU_OPTION_netdev:
-                 default_net = 0;
--                if (net_client_parse(qemu_find_opts("netdev"), optarg) == -1) {
--                    exit(1);
--                }
-+                net_client_parse(qemu_find_opts("netdev"), optarg);
-                 break;
-             case QEMU_OPTION_nic:
-                 default_net = 0;
--                if (net_client_parse(qemu_find_opts("nic"), optarg) == -1) {
--                    exit(1);
--                }
-+                net_client_parse(qemu_find_opts("nic"), optarg);
-                 break;
-             case QEMU_OPTION_net:
-                 default_net = 0;
--                if (net_client_parse(qemu_find_opts("net"), optarg) == -1) {
--                    exit(1);
--                }
-+                net_client_parse(qemu_find_opts("net"), optarg);
-                 break;
- #ifdef CONFIG_LIBISCSI
-             case QEMU_OPTION_iscsi:
---
-.7.4

-[PULL 14/26] qapi: net: introduce a way to bypass qemu_opts_parse_noisily()
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-As qemu_opts_parse_noisily() flattens the QAPI structures ("type" field
-of Netdev structure can collides with "type" field of SocketAddress),
-we introduce a way to bypass qemu_opts_parse_noisily() and use directly
-visit_type_Netdev() to parse the backend parameters.
-More details from Markus:
-qemu_init() passes the argument of -netdev, -nic, and -net to
-net_client_parse().
-net_client_parse() parses with qemu_opts_parse_noisily(), passing
-QemuOptsList qemu_netdev_opts for -netdev, qemu_nic_opts for -nic, and
-qemu_net_opts for -net.  Their desc[] are all empty, which means any
-keys are accepted.  The result of the parse (a QemuOpts) is stored in
-the QemuOptsList.
-Note that QemuOpts is flat by design.  In some places, we layer non-flat
-on top using dotted keys convention, but not here.
-net_init_clients() iterates over the stored QemuOpts, and passes them to
-net_init_netdev(), net_param_nic(), or net_init_client(), respectively.
-These functions pass the QemuOpts to net_client_init().  They also do
-other things with the QemuOpts, which we can ignore here.
-net_client_init() uses the opts visitor to convert the (flat) QemOpts to
-a (non-flat) QAPI object Netdev.  Netdev is also the argument of QMP
-command netdev_add.
-The opts visitor was an early attempt to support QAPI in
-(QemuOpts-based) CLI.  It restricts QAPI types to a certain shape; see
-commit eb7ee2cbeb "qapi: introduce OptsVisitor".
-A more modern way to support QAPI is qobject_input_visitor_new_str().
-It uses keyval_parse() instead of QemuOpts for KEY=VALUE,... syntax, and
-it also supports JSON syntax.  The former isn't quite as expressive as
-JSON, but it's a lot closer than QemuOpts + opts visitor.
-This commit paves the way to use of the modern way instead.
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- include/net/net.h |  2 ++
- net/net.c         | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
- softmmu/vl.c      |  6 +++++-
-files changed, 64 insertions(+), 1 deletion(-)
-diff --git a/include/net/net.h b/include/net/net.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
-+++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ extern NICInfo nd_table[MAX_NICS];
- extern const char *host_net_devices[];
- /* from net.c */
-+bool netdev_is_modern(const char *optarg);
-+void netdev_parse_modern(const char *optarg);
- void net_client_parse(QemuOptsList *opts_list, const char *str);
- void show_netdevs(void);
- void net_init_clients(void);
-diff --git a/net/net.c b/net/net.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
-+++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@
- #include "net/colo-compare.h"
- #include "net/filter.h"
- #include "qapi/string-output-visitor.h"
-+#include "qapi/qobject-input-visitor.h"
- /* Net bridge is currently not supported for W32. */
- #if !defined(_WIN32)
-@@ -XXX,XX +XXX,XX @@
- static VMChangeStateEntry *net_change_state_entry;
- static QTAILQ_HEAD(, NetClientState) net_clients;
-+typedef struct NetdevQueueEntry {
-+    Netdev *nd;
-+    Location loc;
-+    QSIMPLEQ_ENTRY(NetdevQueueEntry) entry;
-+} NetdevQueueEntry;
-+
-+typedef QSIMPLEQ_HEAD(, NetdevQueueEntry) NetdevQueue;
-+
-+static NetdevQueue nd_queue = QSIMPLEQ_HEAD_INITIALIZER(nd_queue);
-+
- /***********************************************************/
- /* network device redirectors */
-@@ -XXX,XX +XXX,XX @@ out:
-     return ret;
- }
-+static void netdev_init_modern(void)
-+{
-+    while (!QSIMPLEQ_EMPTY(&nd_queue)) {
-+        NetdevQueueEntry *nd = QSIMPLEQ_FIRST(&nd_queue);
-+
-+        QSIMPLEQ_REMOVE_HEAD(&nd_queue, entry);
-+        loc_push_restore(&nd->loc);
-+        net_client_init1(nd->nd, true, &error_fatal);
-+        loc_pop(&nd->loc);
-+        qapi_free_Netdev(nd->nd);
-+        g_free(nd);
-+    }
-+}
-+
- void net_init_clients(void)
- {
-     net_change_state_entry =
-@@ -XXX,XX +XXX,XX @@ void net_init_clients(void)
-     QTAILQ_INIT(&net_clients);
-+    netdev_init_modern();
-+
-     qemu_opts_foreach(qemu_find_opts("netdev"), net_init_netdev, NULL,
-                       &error_fatal);
-@@ -XXX,XX +XXX,XX @@ void net_init_clients(void)
-                       &error_fatal);
- }
-+/*
-+ * Does this -netdev argument use modern rather than traditional syntax?
-+ * Modern syntax is to be parsed with netdev_parse_modern().
-+ * Traditional syntax is to be parsed with net_client_parse().
-+ */
-+bool netdev_is_modern(const char *optarg)
-+{
-+    return false;
-+}
-+
-+/*
-+ * netdev_parse_modern() uses modern, more expressive syntax than
-+ * net_client_parse(), but supports only the -netdev option.
-+ * netdev_parse_modern() appends to @nd_queue, whereas net_client_parse()
-+ * appends to @qemu_netdev_opts.
-+ */
-+void netdev_parse_modern(const char *optarg)
-+{
-+    Visitor *v;
-+    NetdevQueueEntry *nd;
-+
-+    v = qobject_input_visitor_new_str(optarg, "type", &error_fatal);
-+    nd = g_new(NetdevQueueEntry, 1);
-+    visit_type_Netdev(v, NULL, &nd->nd, &error_fatal);
-+    visit_free(v);
-+    loc_save(&nd->loc);
-+
-+    QSIMPLEQ_INSERT_TAIL(&nd_queue, nd, entry);
-+}
-+
- void net_client_parse(QemuOptsList *opts_list, const char *optarg)
- {
-     if (!qemu_opts_parse_noisily(opts_list, optarg, true)) {
-diff --git a/softmmu/vl.c b/softmmu/vl.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/vl.c
-+++ b/softmmu/vl.c
-@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
-                 break;
-             case QEMU_OPTION_netdev:
-                 default_net = 0;
--                net_client_parse(qemu_find_opts("netdev"), optarg);
-+                if (netdev_is_modern(optarg)) {
-+                    netdev_parse_modern(optarg);
-+                } else {
-+                    net_client_parse(qemu_find_opts("netdev"), optarg);
-+                }
-                 break;
-             case QEMU_OPTION_nic:
-                 default_net = 0;
---
-.7.4

-[PULL 17/26] net: socket: Don't ignore EINVAL on netdev socket connection
+Deleted patch
-From: Stefano Brivio <sbrivio@redhat.com>
-Other errors are treated as failure by net_socket_connect_init(),
-but if connect() returns EINVAL, we'll fail silently. Remove the
-related exception.
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/socket.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/net/socket.c b/net/socket.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -XXX,XX +XXX,XX @@ static int net_socket_connect_init(NetClientState *peer,
-             if (errno == EINTR || errno == EWOULDBLOCK) {
-                 /* continue */
-             } else if (errno == EINPROGRESS ||
--                       errno == EALREADY ||
--                       errno == EINVAL) {
-+                       errno == EALREADY) {
-                 break;
-             } else {
-                 error_setg_errno(errp, errno, "can't connect socket");
---
-.7.4

-[PULL 21/26] net: dgram: move mcast specific code from net_socket_fd_init_dgram()
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-It is less complex to manage special cases directly in
-net_dgram_mcast_init() and net_dgram_udp_init().
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/dgram.c | 143 ++++++++++++++++++++++++++++++++----------------------------
-file changed, 76 insertions(+), 67 deletions(-)
-diff --git a/net/dgram.c b/net/dgram.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/dgram.c
-+++ b/net/dgram.c
-@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_dgram_socket_info = {
- static NetDgramState *net_dgram_fd_init(NetClientState *peer,
-                                         const char *model,
-                                         const char *name,
--                                        int fd, int is_fd,
--                                        SocketAddress *mcast,
-+                                        int fd,
-                                         Error **errp)
- {
--    struct sockaddr_in *saddr = NULL;
--    int newfd;
-     NetClientState *nc;
-     NetDgramState *s;
--    SocketAddress *sa;
--    SocketAddressType sa_type;
--
--    sa = socket_local_address(fd, errp);
--    if (!sa) {
--        return NULL;
--    }
--    sa_type = sa->type;
--    qapi_free_SocketAddress(sa);
--
--    /*
--     * fd passed: multicast: "learn" dest_addr address from bound address and
--     * save it. Because this may be "shared" socket from a "master" process,
--     * datagrams would be recv() by ONLY ONE process: we must "clone" this
--     * dgram socket --jjo
--     */
--
--    if (is_fd && mcast != NULL) {
--            saddr = g_new(struct sockaddr_in, 1);
--
--            if (convert_host_port(saddr, mcast->u.inet.host, mcast->u.inet.port,
--                                  errp) < 0) {
--                goto err;
--            }
--            /* must be bound */
--            if (saddr->sin_addr.s_addr == 0) {
--                error_setg(errp, "can't setup multicast destination address");
--                goto err;
--            }
--            /* clone dgram socket */
--            newfd = net_dgram_mcast_create(saddr, NULL, errp);
--            if (newfd < 0) {
--                goto err;
--            }
--            /* clone newfd to fd, close newfd */
--            dup2(newfd, fd);
--            close(newfd);
--    }
-     nc = qemu_new_net_client(&net_dgram_socket_info, peer, model, name);
-@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
-     net_socket_rs_init(&s->rs, net_dgram_rs_finalize, false);
-     net_dgram_read_poll(s, true);
--    /* mcast: save bound address as dst */
--    if (saddr) {
--        g_assert(s->dest_addr == NULL);
--        s->dest_addr = (struct sockaddr *)saddr;
--        s->dest_len = sizeof(*saddr);
--        qemu_set_info_str(nc, "fd=%d (cloned mcast=%s:%d)", fd,
--                          inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
--    } else {
--        qemu_set_info_str(nc, "fd=%d %s", fd, SocketAddressType_str(sa_type));
--    }
--
-     return s;
--
--err:
--    g_free(saddr);
--    closesocket(fd);
--    return NULL;
- }
- static int net_dgram_mcast_init(NetClientState *peer,
-@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
-             }
-             break;
-         }
--        case SOCKET_ADDRESS_TYPE_FD:
-+        case SOCKET_ADDRESS_TYPE_FD: {
-+            int newfd;
-+
-             fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
-             if (fd == -1) {
-                 g_free(saddr);
-@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
-                                  name, fd);
-                 return -1;
-             }
-+
-+            /*
-+             * fd passed: multicast: "learn" dest_addr address from bound
-+             * address and save it. Because this may be "shared" socket from a
-+             * "master" process, datagrams would be recv() by ONLY ONE process:
-+             * we must "clone" this dgram socket --jjo
-+             */
-+
-+            saddr = g_new(struct sockaddr_in, 1);
-+
-+            if (convert_host_port(saddr, local->u.inet.host, local->u.inet.port,
-+                                  errp) < 0) {
-+                g_free(saddr);
-+                closesocket(fd);
-+                return -1;
-+            }
-+
-+            /* must be bound */
-+            if (saddr->sin_addr.s_addr == 0) {
-+                error_setg(errp, "can't setup multicast destination address");
-+                g_free(saddr);
-+                closesocket(fd);
-+                return -1;
-+            }
-+            /* clone dgram socket */
-+            newfd = net_dgram_mcast_create(saddr, NULL, errp);
-+            if (newfd < 0) {
-+                g_free(saddr);
-+                closesocket(fd);
-+                return -1;
-+            }
-+            /* clone newfd to fd, close newfd */
-+            dup2(newfd, fd);
-+            close(newfd);
-             break;
-+        }
-         default:
-             g_free(saddr);
-             error_setg(errp, "only support inet or fd type for local");
-@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
-         }
-     }
--    s = net_dgram_fd_init(peer, model, name, fd,
--                          local->type == SOCKET_ADDRESS_TYPE_FD,
--                          remote, errp);
-+    s = net_dgram_fd_init(peer, model, name, fd, errp);
-     if (!s) {
-         g_free(saddr);
-         return -1;
-@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
-     s->dest_addr = (struct sockaddr *)saddr;
-     s->dest_len = sizeof(*saddr);
--    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr->sin_addr),
--                      ntohs(saddr->sin_port));
-+    if (!local) {
-+        qemu_set_info_str(&s->nc, "mcast=%s:%d",
-+                          inet_ntoa(saddr->sin_addr),
-+                          ntohs(saddr->sin_port));
-+    } else {
-+        switch (local->type) {
-+        case SOCKET_ADDRESS_TYPE_INET:
-+            qemu_set_info_str(&s->nc, "mcast=%s:%d",
-+                              inet_ntoa(saddr->sin_addr),
-+                              ntohs(saddr->sin_port));
-+            break;
-+        case SOCKET_ADDRESS_TYPE_FD:
-+            qemu_set_info_str(&s->nc, "fd=%d (cloned mcast=%s:%d)",
-+                              fd, inet_ntoa(saddr->sin_addr),
-+                              ntohs(saddr->sin_port));
-+            break;
-+        default:
-+            g_assert_not_reached();
-+        }
-+    }
-     return 0;
-@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
-         return -1;
-     }
--    s = net_dgram_fd_init(peer, "dgram", name, fd, 0, NULL, errp);
-+    s = net_dgram_fd_init(peer, "dgram", name, fd, errp);
-     if (!s) {
-         return -1;
-     }
-@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
-                           inet_ntoa(raddr_in.sin_addr),
-                           ntohs(raddr_in.sin_port));
-         break;
--    case SOCKET_ADDRESS_TYPE_FD:
--        qemu_set_info_str(&s->nc, "fd=%d", fd);
-+    case SOCKET_ADDRESS_TYPE_FD: {
-+        SocketAddress *sa;
-+        SocketAddressType sa_type;
-+
-+        sa = socket_local_address(fd, errp);
-+        if (sa) {
-+            sa_type = sa->type;
-+            qapi_free_SocketAddress(sa);
-+
-+            qemu_set_info_str(&s->nc, "fd=%d %s", fd,
-+                              SocketAddressType_str(sa_type));
-+        } else {
-+            qemu_set_info_str(&s->nc, "fd=%d", fd);
-+        }
-         break;
-+    }
-     default:
-         g_assert_not_reached();
-     }
---
-.7.4

-[PULL 22/26] net: dgram: add unix socket
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com> (QAPI schema)
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/dgram.c     | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
- qapi/net.json   |  2 +-
- qemu-options.hx |  1 +
-files changed, 56 insertions(+), 2 deletions(-)
-diff --git a/net/dgram.c b/net/dgram.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/dgram.c
-+++ b/net/dgram.c
-@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
-     SocketAddress *remote, *local;
-     struct sockaddr *dest_addr;
-     struct sockaddr_in laddr_in, raddr_in;
-+    struct sockaddr_un laddr_un, raddr_un;
-     socklen_t dest_len;
-     assert(netdev->type == NET_CLIENT_DRIVER_DGRAM);
-@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
-         }
-     } else {
-         if (local->type != SOCKET_ADDRESS_TYPE_FD) {
--            error_setg(errp, "type=inet requires remote parameter");
-+            error_setg(errp,
-+                       "type=inet or type=unix requires remote parameter");
-             return -1;
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
-         dest_addr = g_malloc(dest_len);
-         memcpy(dest_addr, &raddr_in, dest_len);
-         break;
-+    case SOCKET_ADDRESS_TYPE_UNIX:
-+        ret = unlink(local->u.q_unix.path);
-+        if (ret < 0 && errno != ENOENT) {
-+            error_setg_errno(errp, errno, "failed to unlink socket %s",
-+                             local->u.q_unix.path);
-+            return -1;
-+        }
-+
-+        laddr_un.sun_family = PF_UNIX;
-+        ret = snprintf(laddr_un.sun_path, sizeof(laddr_un.sun_path), "%s",
-+                       local->u.q_unix.path);
-+        if (ret < 0 || ret >= sizeof(laddr_un.sun_path)) {
-+            error_setg(errp, "UNIX socket path '%s' is too long",
-+                       local->u.q_unix.path);
-+            error_append_hint(errp, "Path must be less than %zu bytes\n",
-+                              sizeof(laddr_un.sun_path));
-+        }
-+
-+        raddr_un.sun_family = PF_UNIX;
-+        ret = snprintf(raddr_un.sun_path, sizeof(raddr_un.sun_path), "%s",
-+                       remote->u.q_unix.path);
-+        if (ret < 0 || ret >= sizeof(raddr_un.sun_path)) {
-+            error_setg(errp, "UNIX socket path '%s' is too long",
-+                       remote->u.q_unix.path);
-+            error_append_hint(errp, "Path must be less than %zu bytes\n",
-+                              sizeof(raddr_un.sun_path));
-+        }
-+
-+        fd = qemu_socket(PF_UNIX, SOCK_DGRAM, 0);
-+        if (fd < 0) {
-+            error_setg_errno(errp, errno, "can't create datagram socket");
-+            return -1;
-+        }
-+
-+        ret = bind(fd, (struct sockaddr *)&laddr_un, sizeof(laddr_un));
-+        if (ret < 0) {
-+            error_setg_errno(errp, errno, "can't bind unix=%s to socket",
-+                             laddr_un.sun_path);
-+            closesocket(fd);
-+            return -1;
-+        }
-+        qemu_socket_set_nonblock(fd);
-+
-+        dest_len = sizeof(raddr_un);
-+        dest_addr = g_malloc(dest_len);
-+        memcpy(dest_addr, &raddr_un, dest_len);
-+        break;
-     case SOCKET_ADDRESS_TYPE_FD:
-         fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
-         if (fd == -1) {
-@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
-                           inet_ntoa(raddr_in.sin_addr),
-                           ntohs(raddr_in.sin_port));
-         break;
-+    case SOCKET_ADDRESS_TYPE_UNIX:
-+        qemu_set_info_str(&s->nc, "udp=%s:%s",
-+                          laddr_un.sun_path, raddr_un.sun_path);
-+        break;
-     case SOCKET_ADDRESS_TYPE_FD: {
-         SocketAddress *sa;
-         SocketAddressType sa_type;
-diff --git a/qapi/net.json b/qapi/net.json
-index XXXXXXX..XXXXXXX 100644
---- a/qapi/net.json
-+++ b/qapi/net.json
-@@ -XXX,XX +XXX,XX @@
- # @remote: remote address
- # @local: local address
- #
--# Only SocketAddress types 'inet' and 'fd' are supported.
-+# Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
- #
- # If remote address is present and it's a multicast address, local address
- # is optional. Otherwise local address is required and remote address is
-diff --git a/qemu-options.hx b/qemu-options.hx
-index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
-     "                configure a network backend to connect to a multicast maddr and port\n"
-     "                use ``local.host=addr`` to specify the host address to send packets from\n"
-     "-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]\n"
-+    "-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]\n"
-     "-netdev dgram,id=str,local.type=fd,local.str=file-descriptor\n"
-     "                configure a network backend to connect to another network\n"
-     "                using an UDP tunnel\n"
---
-.7.4

-[PULL 23/26] qemu-sockets: move and rename SocketAddress_to_str()
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-Rename SocketAddress_to_str() to socket_uri() and move it to
-util/qemu-sockets.c close to socket_parse().
-socket_uri() generates a string from a SocketAddress while
-socket_parse() generates a SocketAddress from a string.
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- include/qemu/sockets.h |  2 +-
- monitor/hmp-cmds.c     | 23 +----------------------
- util/qemu-sockets.c    | 20 ++++++++++++++++++++
-files changed, 22 insertions(+), 23 deletions(-)
-diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/sockets.h
-+++ b/include/qemu/sockets.h
-@@ -XXX,XX +XXX,XX @@ NetworkAddressFamily inet_netfamily(int family);
- int unix_listen(const char *path, Error **errp);
- int unix_connect(const char *path, Error **errp);
-+char *socket_uri(SocketAddress *addr);
- SocketAddress *socket_parse(const char *str, Error **errp);
- int socket_connect(SocketAddress *addr, Error **errp);
- int socket_listen(SocketAddress *addr, int num, Error **errp);
-@@ -XXX,XX +XXX,XX @@ SocketAddress *socket_address_flatten(SocketAddressLegacy *addr);
-  * Return 0 on success.
-  */
- int socket_address_parse_named_fd(SocketAddress *addr, Error **errp);
--
- #endif /* QEMU_SOCKETS_H */
-diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index XXXXXXX..XXXXXXX 100644
---- a/monitor/hmp-cmds.c
-+++ b/monitor/hmp-cmds.c
-@@ -XXX,XX +XXX,XX @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
-     qapi_free_MouseInfoList(mice_list);
- }
--static char *SocketAddress_to_str(SocketAddress *addr)
--{
--    switch (addr->type) {
--    case SOCKET_ADDRESS_TYPE_INET:
--        return g_strdup_printf("tcp:%s:%s",
--                               addr->u.inet.host,
--                               addr->u.inet.port);
--    case SOCKET_ADDRESS_TYPE_UNIX:
--        return g_strdup_printf("unix:%s",
--                               addr->u.q_unix.path);
--    case SOCKET_ADDRESS_TYPE_FD:
--        return g_strdup_printf("fd:%s", addr->u.fd.str);
--    case SOCKET_ADDRESS_TYPE_VSOCK:
--        return g_strdup_printf("tcp:%s:%s",
--                               addr->u.vsock.cid,
--                               addr->u.vsock.port);
--    default:
--        return g_strdup("unknown address type");
--    }
--}
--
- void hmp_info_migrate(Monitor *mon, const QDict *qdict)
- {
-     MigrationInfo *info;
-@@ -XXX,XX +XXX,XX @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
-         monitor_printf(mon, "socket address: [\n");
-         for (addr = info->socket_address; addr; addr = addr->next) {
--            char *s = SocketAddress_to_str(addr->value);
-+            char *s = socket_uri(addr->value);
-             monitor_printf(mon, "\t%s\n", s);
-             g_free(s);
-         }
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -XXX,XX +XXX,XX @@ int unix_connect(const char *path, Error **errp)
-     return sock;
- }
-+char *socket_uri(SocketAddress *addr)
-+{
-+    switch (addr->type) {
-+    case SOCKET_ADDRESS_TYPE_INET:
-+        return g_strdup_printf("tcp:%s:%s",
-+                               addr->u.inet.host,
-+                               addr->u.inet.port);
-+    case SOCKET_ADDRESS_TYPE_UNIX:
-+        return g_strdup_printf("unix:%s",
-+                               addr->u.q_unix.path);
-+    case SOCKET_ADDRESS_TYPE_FD:
-+        return g_strdup_printf("fd:%s", addr->u.fd.str);
-+    case SOCKET_ADDRESS_TYPE_VSOCK:
-+        return g_strdup_printf("tcp:%s:%s",
-+                               addr->u.vsock.cid,
-+                               addr->u.vsock.port);
-+    default:
-+        return g_strdup("unknown address type");
-+    }
-+}
- SocketAddress *socket_parse(const char *str, Error **errp)
- {
---
-.7.4

-[PULL 24/26] qemu-sockets: update socket_uri() and socket_parse() to be consistent
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-To be consistent with socket_uri(), add 'tcp:' prefix for inet type in
-socket_parse(), by default socket_parse() use tcp when no prefix is
-provided (format is host:port).
-In socket_uri(), use 'vsock:' prefix for vsock type rather than 'tcp:'
-because it makes a vsock address look like an inet address with CID
-misinterpreted as host.
-Goes back to commit 9aca82ba31 "migration: Create socket-address parameter"
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- util/qemu-sockets.c | 7 ++++++-
-file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -XXX,XX +XXX,XX @@ char *socket_uri(SocketAddress *addr)
-     case SOCKET_ADDRESS_TYPE_FD:
-         return g_strdup_printf("fd:%s", addr->u.fd.str);
-     case SOCKET_ADDRESS_TYPE_VSOCK:
--        return g_strdup_printf("tcp:%s:%s",
-+        return g_strdup_printf("vsock:%s:%s",
-                                addr->u.vsock.cid,
-                                addr->u.vsock.port);
-     default:
-@@ -XXX,XX +XXX,XX @@ SocketAddress *socket_parse(const char *str, Error **errp)
-         if (vsock_parse(&addr->u.vsock, str + strlen("vsock:"), errp)) {
-             goto fail;
-         }
-+    } else if (strstart(str, "tcp:", NULL)) {
-+        addr->type = SOCKET_ADDRESS_TYPE_INET;
-+        if (inet_parse(&addr->u.inet, str + strlen("tcp:"), errp)) {
-+            goto fail;
-+        }
-     } else {
-         addr->type = SOCKET_ADDRESS_TYPE_INET;
-         if (inet_parse(&addr->u.inet, str, errp)) {
---
-.7.4

-[PULL 26/26] net: stream: add QAPI events to report connection state
+Deleted patch
-From: Laurent Vivier <lvivier@redhat.com>
-The netdev reports NETDEV_STREAM_CONNECTED event when the backend
-is connected, and NETDEV_STREAM_DISCONNECTED when it is disconnected.
-The NETDEV_STREAM_CONNECTED event includes the destination address.
-This allows a system manager like libvirt to detect when the server
-fails.
-For instance with passt:
-{ 'execute': 'qmp_capabilities' }
-{ "return": { } }
-{ "timestamp": { "seconds": 1666341395, "microseconds": 505347 },
-    "event": "NETDEV_STREAM_CONNECTED",
-    "data": { "netdev-id": "netdev0",
-        "addr": { "path": "/tmp/passt_1.socket", "type": "unix" } } }
-[killing passt here]
-{ "timestamp": { "seconds": 1666341430, "microseconds": 968694 },
-    "event": "NETDEV_STREAM_DISCONNECTED",
-    "data": { "netdev-id": "netdev0" } }
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/stream.c  |  5 +++++
- qapi/net.json | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
-files changed, 54 insertions(+)
-diff --git a/net/stream.c b/net/stream.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/stream.c
-+++ b/net/stream.c
-@@ -XXX,XX +XXX,XX @@
- #include "io/channel.h"
- #include "io/channel-socket.h"
- #include "io/net-listener.h"
-+#include "qapi/qapi-events-net.h"
- typedef struct NetStreamState {
-     NetClientState nc;
-@@ -XXX,XX +XXX,XX @@ static gboolean net_stream_send(QIOChannel *ioc,
-         s->nc.link_down = true;
-         qemu_set_info_str(&s->nc, "");
-+        qapi_event_send_netdev_stream_disconnected(s->nc.name);
-+
-         return G_SOURCE_REMOVE;
-     }
-     buf = buf1;
-@@ -XXX,XX +XXX,XX @@ static void net_stream_listen(QIONetListener *listener,
-     uri = socket_uri(addr);
-     qemu_set_info_str(&s->nc, uri);
-     g_free(uri);
-+    qapi_event_send_netdev_stream_connected(s->nc.name, addr);
-     qapi_free_SocketAddress(addr);
- }
-@@ -XXX,XX +XXX,XX @@ static void net_stream_client_connected(QIOTask *task, gpointer opaque)
-     s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
-                                             s, NULL);
-     s->nc.link_down = false;
-+    qapi_event_send_netdev_stream_connected(s->nc.name, addr);
-     qapi_free_SocketAddress(addr);
-     return;
-diff --git a/qapi/net.json b/qapi/net.json
-index XXXXXXX..XXXXXXX 100644
---- a/qapi/net.json
-+++ b/qapi/net.json
-@@ -XXX,XX +XXX,XX @@
- ##
- { 'event': 'FAILOVER_NEGOTIATED',
-   'data': {'device-id': 'str'} }
-+
-+##
-+# @NETDEV_STREAM_CONNECTED:
-+#
-+# Emitted when the netdev stream backend is connected
-+#
-+# @netdev-id: QEMU netdev id that is connected
-+# @addr: The destination address
-+#
-+# Since: 7.2
-+#
-+# Example:
-+#
-+# <- { "event": "NETDEV_STREAM_CONNECTED",
-+#      "data": { "netdev-id": "netdev0",
-+#                "addr": { "port": "47666", "ipv6": true,
-+#                          "host": "::1", "type": "inet" } },
-+#      "timestamp": { "seconds": 1666269863, "microseconds": 311222 } }
-+#
-+# or
-+#
-+# <- { "event": "NETDEV_STREAM_CONNECTED",
-+#      "data": { "netdev-id": "netdev0",
-+#                "addr": { "path": "/tmp/qemu0", "type": "unix" } },
-+#      "timestamp": { "seconds": 1666269706, "microseconds": 413651 } }
-+#
-+##
-+{ 'event': 'NETDEV_STREAM_CONNECTED',
-+  'data': { 'netdev-id': 'str',
-+            'addr': 'SocketAddress' } }
-+
-+##
-+# @NETDEV_STREAM_DISCONNECTED:
-+#
-+# Emitted when the netdev stream backend is disconnected
-+#
-+# @netdev-id: QEMU netdev id that is disconnected
-+#
-+# Since: 7.2
-+#
-+# Example:
-+#
-+# <- { 'event': 'NETDEV_STREAM_DISCONNECTED',
-+#      'data': {'netdev-id': 'netdev0'},
-+#      'timestamp': {'seconds': 1663330937, 'microseconds': 526695} }
-+#
-+##
-+{ 'event': 'NETDEV_STREAM_DISCONNECTED',
-+  'data': { 'netdev-id': 'str' } }
---
-.7.4

The following changes since commit 344744e148e6e865f5a57e745b02a87e5ea534ad:

Merge tag 'dump-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2022-10-26 10:53:49 -0400)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to e506fee8b1e092f6ac6f9459bf6a35b807644ad2:

net: stream: add QAPI events to report connection state (2022-10-28 13:28:52 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Daniel P. Berrangé (1):
      net: improve error message for missing netdev backend

Eugenio Pérez (6):
      vdpa: Delete duplicated vdpa_feature_bits entry
      vdpa: Remove shadow CVQ command check
      vhost: allocate event_idx fields on vring
      vhost: toggle device callbacks using used event idx
      vhost: use avail event idx on vhost_svq_kick
      vhost: Accept event idx flag

Laurent Vivier (16):
      virtio-net: fix bottom-half packet TX on asynchronous completion
      virtio-net: fix TX timer with tx_burst
      net: introduce convert_host_port()
      net: remove the @errp argument of net_client_inits()
      net: simplify net_client_parse() error management
      qapi: net: introduce a way to bypass qemu_opts_parse_noisily()
      net: introduce qemu_set_info_str() function
      qapi: net: add stream and dgram netdevs
      net: stream: add unix socket
      net: dgram: make dgram_dst generic
      net: dgram: move mcast specific code from net_socket_fd_init_dgram()
      net: dgram: add unix socket
      qemu-sockets: move and rename SocketAddress_to_str()
      qemu-sockets: update socket_uri() and socket_parse() to be consistent
      net: stream: move to QIO to enable additional parameters
      net: stream: add QAPI events to report connection state

Si-Wei Liu (1):
      vhost-vdpa: allow passing opened vhostfd to vhost-vdpa

Stefano Brivio (2):
      net: socket: Don't ignore EINVAL on netdev socket connection
      net: stream: Don't ignore EINVAL on netdev socket connection

From: Laurent Vivier <lvivier@redhat.com>

When virtio-net is used with the socket netdev backend, the backend
can be busy and not able to collect new packets.

In this case, net_socket_receive() returns 0 and registers a poll function
to detect when the socket is ready again.

In virtio_net_tx_bh(), virtio_net_flush_tx() forwards the 0, the virtio
notifications are disabled and the function is not re-scheduled, waiting
for the backend to be ready.

When the socket netdev backend is again able to send packets, the poll
function re-starts to flush remaining packets. This is done by
calling virtio_net_tx_complete(). It re-enables notifications and calls
again virtio_net_flush_tx().

But it seems if virtio_net_flush_tx() reaches the tx_burst value all
the queue is not flushed and no new notification is sent to re-schedule
virtio_net_tx_bh(). Nothing re-start to flush the queue and remaining
packets are stuck in the queue.

To fix that, detect in virtio_net_tx_complete() if virtio_net_flush_tx()
has been stopped by tx_burst and if yes re-schedule the bottom half
function virtio_net_tx_bh() to flush the remaining packets.

This is what is done in virtio_net_tx_bh() when the virtio_net_flush_tx()
is synchronous, and completly by-passed when the operation needs to be
asynchronous.

Fixes: a697a334b3c4 ("virtio-net: Introduce a new bottom half packet TX")
Cc: alex.williamson@redhat.com
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

From: Laurent Vivier <lvivier@redhat.com>

When virtio_net_flush_tx() reaches the tx_burst value all
the queue is not flushed and nothing restart the timer.

Fix that by doing for TX timer as we do for bottom half TX:
rearming the timer if we find any packet to send during the
virtio_net_flush_tx() call.

Fixes: e3f30488e5f8 ("virtio-net: Limit number of packets sent per TX flush")
Cc: alex.williamson@redhat.com
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 50 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 41 insertions(+), 9 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_complete(NetClientState *nc, ssize_t len)
 
     virtio_queue_set_notification(q->tx_vq, 1);
     ret = virtio_net_flush_tx(q);
-    if (q->tx_bh && ret >= n->tx_burst) {
+    if (ret >= n->tx_burst) {
         /*
          * the flush has been stopped by tx_burst
          * we will not receive notification for the
          * remainining part, so re-schedule
          */
         virtio_queue_set_notification(q->tx_vq, 0);
-        qemu_bh_schedule(q->tx_bh);
+        if (q->tx_bh) {
+            qemu_bh_schedule(q->tx_bh);
+        } else {
+            timer_mod(q->tx_timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
+        }
         q->tx_waiting = 1;
     }
 }
@@ -XXX,XX +XXX,XX @@ drop:
     return num_packets;
 }
 
+static void virtio_net_tx_timer(void *opaque);
+
 static void virtio_net_handle_tx_timer(VirtIODevice *vdev, VirtQueue *vq)
 {
     VirtIONet *n = VIRTIO_NET(vdev);
@@ -XXX,XX +XXX,XX @@ static void virtio_net_handle_tx_timer(VirtIODevice *vdev, VirtQueue *vq)
     }
 
     if (q->tx_waiting) {
-        virtio_queue_set_notification(vq, 1);
+        /* We already have queued packets, immediately flush */
         timer_del(q->tx_timer);
-        q->tx_waiting = 0;
-        if (virtio_net_flush_tx(q) == -EINVAL) {
-            return;
-        }
+        virtio_net_tx_timer(q);
     } else {
+        /* re-arm timer to flush it (and more) on next tick */
         timer_mod(q->tx_timer,
-                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
+                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
         q->tx_waiting = 1;
         virtio_queue_set_notification(vq, 0);
     }
@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_timer(void *opaque)
     VirtIONetQueue *q = opaque;
     VirtIONet *n = q->n;
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
+    int ret;
+
     /* This happens when device was stopped but BH wasn't. */
     if (!vdev->vm_running) {
         /* Make sure tx waiting is set, so we'll run when restarted. */
@@ -XXX,XX +XXX,XX @@ static void virtio_net_tx_timer(void *opaque)
         return;
     }
 
+    ret = virtio_net_flush_tx(q);
+    if (ret == -EBUSY || ret == -EINVAL) {
+        return;
+    }
+    /*
+     * If we flush a full burst of packets, assume there are
+     * more coming and immediately rearm
+     */
+    if (ret >= n->tx_burst) {
+        q->tx_waiting = 1;
+        timer_mod(q->tx_timer,
+                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
+        return;
+    }
+    /*
+     * If less than a full burst, re-enable notification and flush
+     * anything that may have come in while we weren't looking.  If
+     * we find something, assume the guest is still active and rearm
+     */
     virtio_queue_set_notification(q->tx_vq, 1);
-    virtio_net_flush_tx(q);
+    ret = virtio_net_flush_tx(q);
+    if (ret > 0) {
+        virtio_queue_set_notification(q->tx_vq, 0);
+        q->tx_waiting = 1;
+        timer_mod(q->tx_timer,
+                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + n->tx_timeout);
+    }
 }
 
 static void virtio_net_tx_bh(void *opaque)
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

The guest will see undefined behavior if it issue not negotiate
commands, bit it is expected somehow.

Simplify code deleting this check.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vhost-vdpa.c | 48 ------------------------------------------------
 1 file changed, 48 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_vhost_vdpa_cvq_info = {
 };
 
 /**
- * Do not forward commands not supported by SVQ. Otherwise, the device could
- * accept it and qemu would not know how to update the device model.
- */
-static bool vhost_vdpa_net_cvq_validate_cmd(const void *out_buf, size_t len)
-{
-    struct virtio_net_ctrl_hdr ctrl;
-
-    if (unlikely(len < sizeof(ctrl))) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "%s: invalid legnth of out buffer %zu\n", __func__, len);
-        return false;
-    }
-
-    memcpy(&ctrl, out_buf, sizeof(ctrl));
-    switch (ctrl.class) {
-    case VIRTIO_NET_CTRL_MAC:
-        switch (ctrl.cmd) {
-        case VIRTIO_NET_CTRL_MAC_ADDR_SET:
-            return true;
-        default:
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid mac cmd %u\n",
-                          __func__, ctrl.cmd);
-        };
-        break;
-    case VIRTIO_NET_CTRL_MQ:
-        switch (ctrl.cmd) {
-        case VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET:
-            return true;
-        default:
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid mq cmd %u\n",
-                          __func__, ctrl.cmd);
-        };
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid control class %u\n",
-                      __func__, ctrl.class);
-    };
-
-    return false;
-}
-
-/**
  * Validate and copy control virtqueue commands.
  *
  * Following QEMU guidelines, we offer a copy of the buffers to the device to
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
         .iov_len = sizeof(status),
     };
     ssize_t dev_written = -EINVAL;
-    bool ok;
 
     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
                              s->cvq_cmd_out_buffer,
                              vhost_vdpa_net_cvq_cmd_len());
-    ok = vhost_vdpa_net_cvq_validate_cmd(s->cvq_cmd_out_buffer, out.iov_len);
-    if (unlikely(!ok)) {
-        goto out;
-    }
-
     dev_written = vhost_vdpa_net_cvq_add(s, out.iov_len, sizeof(status));
     if (unlikely(dev_written < 0)) {
         goto out;
-- 
2.7.4

From: Si-Wei Liu <si-wei.liu@oracle.com>

Similar to other vhost backends, vhostfd can be passed to vhost-vdpa
backend as another parameter to instantiate vhost-vdpa net client.
This would benefit the use case where only open file descriptors, as
opposed to raw vhost-vdpa device paths, are accessible from the QEMU
process.

(qemu) netdev_add type=vhost-vdpa,vhostfd=61,id=vhost-vdpa1

Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vhost-vdpa.c | 25 ++++++++++++++++++++-----
 qapi/net.json    |  3 +++
 qemu-options.hx  |  6 ++++--
 3 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
 
     assert(netdev->type == NET_CLIENT_DRIVER_VHOST_VDPA);
     opts = &netdev->u.vhost_vdpa;
-    if (!opts->vhostdev) {
-        error_setg(errp, "vdpa character device not specified with vhostdev");
+    if (!opts->has_vhostdev && !opts->has_vhostfd) {
+        error_setg(errp,
+                   "vhost-vdpa: neither vhostdev= nor vhostfd= was specified");
         return -1;
     }
 
-    vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
-    if (vdpa_device_fd == -1) {
-        return -errno;
+    if (opts->has_vhostdev && opts->has_vhostfd) {
+        error_setg(errp,
+                   "vhost-vdpa: vhostdev= and vhostfd= are mutually exclusive");
+        return -1;
+    }
+
+    if (opts->has_vhostdev) {
+        vdpa_device_fd = qemu_open(opts->vhostdev, O_RDWR, errp);
+        if (vdpa_device_fd == -1) {
+            return -errno;
+        }
+    } else if (opts->has_vhostfd) {
+        vdpa_device_fd = monitor_fd_param(monitor_cur(), opts->vhostfd, errp);
+        if (vdpa_device_fd == -1) {
+            error_prepend(errp, "vhost-vdpa: unable to parse vhostfd: ");
+            return -1;
+        }
     }
 
     r = vhost_vdpa_get_features(vdpa_device_fd, &features, errp);
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 # @vhostdev: path of vhost-vdpa device
 #            (default:'/dev/vhost-vdpa-0')
 #
+# @vhostfd: file descriptor of an already opened vhost vdpa device
+#
 # @queues: number of queues to be created for multiqueue vhost-vdpa
 #          (default: 1)
 #
@@ -XXX,XX +XXX,XX @@
 { 'struct': 'NetdevVhostVDPAOptions',
   'data': {
     '*vhostdev':     'str',
+    '*vhostfd':      'str',
     '*queues':       'int',
     '*x-svq':        {'type': 'bool', 'features' : [ 'unstable'] } } }
 
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "                configure a vhost-user network, backed by a chardev 'dev'\n"
 #endif
 #ifdef __linux__
-    "-netdev vhost-vdpa,id=str,vhostdev=/path/to/dev\n"
+    "-netdev vhost-vdpa,id=str[,vhostdev=/path/to/dev][,vhostfd=h]\n"
     "                configure a vhost-vdpa network,Establish a vhost-vdpa netdev\n"
+    "                use 'vhostdev=/path/to/dev' to open a vhost vdpa device\n"
+    "                use 'vhostfd=h' to connect to an already opened vhost vdpa device\n"
 #endif
 #ifdef CONFIG_VMNET
     "-netdev vmnet-host,id=str[,isolated=on|off][,net-uuid=uuid]\n"
@@ -XXX,XX +XXX,XX @@ SRST
              -netdev type=vhost-user,id=net0,chardev=chr0 \
              -device virtio-net-pci,netdev=net0
 
-``-netdev vhost-vdpa,vhostdev=/path/to/dev``
+``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
     Establish a vhost-vdpa netdev.
 
     vDPA device is a device that uses a datapath which complies with
-- 
2.7.4

From: Daniel P. Berrangé <berrange@redhat.com>

The current message when using '-net user...' with SLIRP disabled at
compile time is:

qemu-system-x86_64: -net user: Parameter 'type' expects a net backend type (maybe it is not compiled into this binary)

An observation is that we're using the 'netdev->type' field here which
is an enum value, produced after QAPI has converted from its string
form.

IOW, at this point in the code, we know that the user's specified
type name was a valid network backend. The only possible scenario that
can make the backend init function be NULL, is if support for that
backend was disabled at build time. Given this, we don't need to caveat
our error message with a 'maybe' hint, we can be totally explicit.

The use of QERR_INVALID_PARAMETER_VALUE doesn't really lend itself to
user friendly error message text. Since this is not used to set a
specific QAPI error class, we can simply stop using this pre-formatted
error text and provide something better.

Thus the new message is:

qemu-system-x86_64: -net user: network backend 'user' is not compiled into this binary

The case of passing 'hubport' for -net is also given a message reminding
people they should have used -netdev/-nic instead, as this backend type
is only valid for the modern syntax.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
     if (is_netdev) {
         if (netdev->type == NET_CLIENT_DRIVER_NIC ||
             !net_client_init_fun[netdev->type]) {
-            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
-                       "a netdev backend type");
+            error_setg(errp, "network backend '%s' is not compiled into this binary",
+                       NetClientDriver_str(netdev->type));
             return -1;
         }
     } else {
         if (netdev->type == NET_CLIENT_DRIVER_NONE) {
             return 0; /* nothing to do */
         }
-        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT ||
-            !net_client_init_fun[netdev->type]) {
-            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
-                       "a net backend type (maybe it is not compiled "
-                       "into this binary)");
+        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT) {
+            error_setg(errp, "network backend '%s' is only supported with -netdev/-nic",
+                       NetClientDriver_str(netdev->type));
+            return -1;
+        }
+
+        if (!net_client_init_fun[netdev->type]) {
+            error_setg(errp, "network backend '%s' is not compiled into this binary",
+                       NetClientDriver_str(netdev->type));
             return -1;
         }
 
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

There was not enough room to accomodate them.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@ void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
 size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq)
 {
     size_t desc_size = sizeof(vring_desc_t) * svq->vring.num;
-    size_t avail_size = offsetof(vring_avail_t, ring) +
-                                             sizeof(uint16_t) * svq->vring.num;
+    size_t avail_size = offsetof(vring_avail_t, ring[svq->vring.num]) +
+                                                              sizeof(uint16_t);
 
     return ROUND_UP(desc_size + avail_size, qemu_real_host_page_size());
 }
 
 size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq)
 {
-    size_t used_size = offsetof(vring_used_t, ring) +
-                                    sizeof(vring_used_elem_t) * svq->vring.num;
+    size_t used_size = offsetof(vring_used_t, ring[svq->vring.num]) +
+                                                              sizeof(uint16_t);
     return ROUND_UP(used_size, qemu_real_host_page_size());
 }
 
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

Actually use the new field of the used ring and tell the device if SVQ
wants to be notified.

The code is not reachable at the moment.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_more_used(VhostShadowVirtqueue *svq)
  */
 static bool vhost_svq_enable_notification(VhostShadowVirtqueue *svq)
 {
-    svq->vring.avail->flags &= ~cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
-    /* Make sure the flag is written before the read of used_idx */
+    if (virtio_vdev_has_feature(svq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
+        uint16_t *used_event = (uint16_t *)&svq->vring.avail->ring[svq->vring.num];
+        *used_event = svq->shadow_used_idx;
+    } else {
+        svq->vring.avail->flags &= ~cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
+    }
+
+    /* Make sure the event is enabled before the read of used_idx */
     smp_mb();
     return !vhost_svq_more_used(svq);
 }
 
 static void vhost_svq_disable_notification(VhostShadowVirtqueue *svq)
 {
-    svq->vring.avail->flags |= cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
+    /*
+     * No need to disable notification in the event idx case, since used event
+     * index is already an index too far away.
+     */
+    if (!virtio_vdev_has_feature(svq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
+        svq->vring.avail->flags |= cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
+    }
 }
 
 static uint16_t vhost_svq_last_desc_of_chain(const VhostShadowVirtqueue *svq,
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

So SVQ code knows if an event is needed.

The code is not reachable at the moment.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
 
 static void vhost_svq_kick(VhostShadowVirtqueue *svq)
 {
+    bool needs_kick;
+
     /*
      * We need to expose the available array entries before checking the used
      * flags
      */
     smp_mb();
-    if (svq->vring.used->flags & VRING_USED_F_NO_NOTIFY) {
+
+    if (virtio_vdev_has_feature(svq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
+        uint16_t avail_event = *(uint16_t *)(&svq->vring.used->ring[svq->vring.num]);
+        needs_kick = vring_need_event(avail_event, svq->shadow_avail_idx, svq->shadow_avail_idx - 1);
+    } else {
+        needs_kick = !(svq->vring.used->flags & VRING_USED_F_NO_NOTIFY);
+    }
+
+    if (!needs_kick) {
         return;
     }
 
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/qemu/sockets.h |  2 ++
 net/net.c              | 62 ++++++++++++++++++++++++++------------------------
 2 files changed, 34 insertions(+), 30 deletions(-)

diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -XXX,XX +XXX,XX @@ void socket_listen_cleanup(int fd, Error **errp);
 int socket_dgram(SocketAddress *remote, SocketAddress *local, Error **errp);
 
 /* Old, ipv4 only bits.  Don't use for new code. */
+int convert_host_port(struct sockaddr_in *saddr, const char *host,
+                      const char *port, Error **errp);
 int parse_host_port(struct sockaddr_in *saddr, const char *str,
                     Error **errp);
 int socket_init(void);
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static QTAILQ_HEAD(, NetClientState) net_clients;
 /***********************************************************/
 /* network device redirectors */
 
-int parse_host_port(struct sockaddr_in *saddr, const char *str,
-                    Error **errp)
+int convert_host_port(struct sockaddr_in *saddr, const char *host,
+                      const char *port, Error **errp)
 {
-    gchar **substrings;
     struct hostent *he;
-    const char *addr, *p, *r;
-    int port, ret = 0;
+    const char *r;
+    long p;
 
     memset(saddr, 0, sizeof(*saddr));
 
-    substrings = g_strsplit(str, ":", 2);
-    if (!substrings || !substrings[0] || !substrings[1]) {
-        error_setg(errp, "host address '%s' doesn't contain ':' "
-                   "separating host from port", str);
-        ret = -1;
-        goto out;
-    }
-
-    addr = substrings[0];
-    p = substrings[1];
-
     saddr->sin_family = AF_INET;
-    if (addr[0] == '\0') {
+    if (host[0] == '\0') {
         saddr->sin_addr.s_addr = 0;
     } else {
-        if (qemu_isdigit(addr[0])) {
-            if (!inet_aton(addr, &saddr->sin_addr)) {
+        if (qemu_isdigit(host[0])) {
+            if (!inet_aton(host, &saddr->sin_addr)) {
                 error_setg(errp, "host address '%s' is not a valid "
-                           "IPv4 address", addr);
-                ret = -1;
-                goto out;
+                           "IPv4 address", host);
+                return -1;
             }
         } else {
-            he = gethostbyname(addr);
+            he = gethostbyname(host);
             if (he == NULL) {
-                error_setg(errp, "can't resolve host address '%s'", addr);
-                ret = -1;
-                goto out;
+                error_setg(errp, "can't resolve host address '%s'", host);
+                return -1;
             }
             saddr->sin_addr = *(struct in_addr *)he->h_addr;
         }
     }
-    port = strtol(p, (char **)&r, 0);
-    if (r == p) {
-        error_setg(errp, "port number '%s' is invalid", p);
+    if (qemu_strtol(port, &r, 0, &p) != 0) {
+        error_setg(errp, "port number '%s' is invalid", port);
+        return -1;
+    }
+    saddr->sin_port = htons(p);
+    return 0;
+}
+
+int parse_host_port(struct sockaddr_in *saddr, const char *str,
+                    Error **errp)
+{
+    gchar **substrings;
+    int ret;
+
+    substrings = g_strsplit(str, ":", 2);
+    if (!substrings || !substrings[0] || !substrings[1]) {
+        error_setg(errp, "host address '%s' doesn't contain ':' "
+                   "separating host from port", str);
         ret = -1;
         goto out;
     }
-    saddr->sin_port = htons(port);
+
+    ret = convert_host_port(saddr, substrings[0], substrings[1], errp);
 
 out:
     g_strfreev(substrings);
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

The only caller passes &error_fatal, so use this directly in the function.

It's what we do for -blockdev, -device, and -object.

Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h |  2 +-
 net/net.c         | 20 +++++++-------------
 softmmu/vl.c      |  2 +-
 3 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
 /* from net.c */
 int net_client_parse(QemuOptsList *opts_list, const char *str);
 void show_netdevs(void);
-int net_init_clients(Error **errp);
+void net_init_clients(void);
 void net_check_clients(void);
 void net_cleanup(void);
 void hmp_host_net_add(Monitor *mon, const QDict *qdict);
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ out:
     return ret;
 }
 
-int net_init_clients(Error **errp)
+void net_init_clients(void)
 {
     net_change_state_entry =
         qemu_add_vm_change_state_handler(net_vm_change_state_handler, NULL);
 
     QTAILQ_INIT(&net_clients);
 
-    if (qemu_opts_foreach(qemu_find_opts("netdev"),
-                          net_init_netdev, NULL, errp)) {
-        return -1;
-    }
-
-    if (qemu_opts_foreach(qemu_find_opts("nic"), net_param_nic, NULL, errp)) {
-        return -1;
-    }
+    qemu_opts_foreach(qemu_find_opts("netdev"), net_init_netdev, NULL,
+                      &error_fatal);
 
-    if (qemu_opts_foreach(qemu_find_opts("net"), net_init_client, NULL, errp)) {
-        return -1;
-    }
+    qemu_opts_foreach(qemu_find_opts("nic"), net_param_nic, NULL,
+                      &error_fatal);
 
-    return 0;
+    qemu_opts_foreach(qemu_find_opts("net"), net_init_client, NULL,
+                      &error_fatal);
 }
 
 int net_client_parse(QemuOptsList *opts_list, const char *optarg)
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static void qemu_create_late_backends(void)
         qtest_server_init(qtest_chrdev, qtest_log, &error_fatal);
     }
 
-    net_init_clients(&error_fatal);
+    net_init_clients();
 
     object_option_foreach_add(object_create_late);
 
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

All net_client_parse() callers exit in case of error.

Move exit(1) to net_client_parse() and remove error checking from
the callers.

Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h |  2 +-
 net/net.c         |  6 ++----
 softmmu/vl.c      | 12 +++---------
 3 files changed, 6 insertions(+), 14 deletions(-)

From: Laurent Vivier <lvivier@redhat.com>

As qemu_opts_parse_noisily() flattens the QAPI structures ("type" field
of Netdev structure can collides with "type" field of SocketAddress),
we introduce a way to bypass qemu_opts_parse_noisily() and use directly
visit_type_Netdev() to parse the backend parameters.

More details from Markus:

qemu_init() passes the argument of -netdev, -nic, and -net to
net_client_parse().

net_client_parse() parses with qemu_opts_parse_noisily(), passing
QemuOptsList qemu_netdev_opts for -netdev, qemu_nic_opts for -nic, and
qemu_net_opts for -net.  Their desc[] are all empty, which means any
keys are accepted.  The result of the parse (a QemuOpts) is stored in
the QemuOptsList.

Note that QemuOpts is flat by design.  In some places, we layer non-flat
on top using dotted keys convention, but not here.

net_init_clients() iterates over the stored QemuOpts, and passes them to
net_init_netdev(), net_param_nic(), or net_init_client(), respectively.

These functions pass the QemuOpts to net_client_init().  They also do
other things with the QemuOpts, which we can ignore here.

net_client_init() uses the opts visitor to convert the (flat) QemOpts to
a (non-flat) QAPI object Netdev.  Netdev is also the argument of QMP
command netdev_add.

The opts visitor was an early attempt to support QAPI in
(QemuOpts-based) CLI.  It restricts QAPI types to a certain shape; see
commit eb7ee2cbeb "qapi: introduce OptsVisitor".

A more modern way to support QAPI is qobject_input_visitor_new_str().
It uses keyval_parse() instead of QemuOpts for KEY=VALUE,... syntax, and
it also supports JSON syntax.  The former isn't quite as expressive as
JSON, but it's a lot closer than QemuOpts + opts visitor.

This commit paves the way to use of the modern way instead.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h |  2 ++
 net/net.c         | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 softmmu/vl.c      |  6 +++++-
 3 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ extern NICInfo nd_table[MAX_NICS];
 extern const char *host_net_devices[];
 
 /* from net.c */
+bool netdev_is_modern(const char *optarg);
+void netdev_parse_modern(const char *optarg);
 void net_client_parse(QemuOptsList *opts_list, const char *str);
 void show_netdevs(void);
 void net_init_clients(void);
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
 #include "net/colo-compare.h"
 #include "net/filter.h"
 #include "qapi/string-output-visitor.h"
+#include "qapi/qobject-input-visitor.h"
 
 /* Net bridge is currently not supported for W32. */
 #if !defined(_WIN32)
@@ -XXX,XX +XXX,XX @@
 static VMChangeStateEntry *net_change_state_entry;
 static QTAILQ_HEAD(, NetClientState) net_clients;
 
+typedef struct NetdevQueueEntry {
+    Netdev *nd;
+    Location loc;
+    QSIMPLEQ_ENTRY(NetdevQueueEntry) entry;
+} NetdevQueueEntry;
+
+typedef QSIMPLEQ_HEAD(, NetdevQueueEntry) NetdevQueue;
+
+static NetdevQueue nd_queue = QSIMPLEQ_HEAD_INITIALIZER(nd_queue);
+
 /***********************************************************/
 /* network device redirectors */
 
@@ -XXX,XX +XXX,XX @@ out:
     return ret;
 }
 
+static void netdev_init_modern(void)
+{
+    while (!QSIMPLEQ_EMPTY(&nd_queue)) {
+        NetdevQueueEntry *nd = QSIMPLEQ_FIRST(&nd_queue);
+
+        QSIMPLEQ_REMOVE_HEAD(&nd_queue, entry);
+        loc_push_restore(&nd->loc);
+        net_client_init1(nd->nd, true, &error_fatal);
+        loc_pop(&nd->loc);
+        qapi_free_Netdev(nd->nd);
+        g_free(nd);
+    }
+}
+
 void net_init_clients(void)
 {
     net_change_state_entry =
@@ -XXX,XX +XXX,XX @@ void net_init_clients(void)
 
     QTAILQ_INIT(&net_clients);
 
+    netdev_init_modern();
+
     qemu_opts_foreach(qemu_find_opts("netdev"), net_init_netdev, NULL,
                       &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ void net_init_clients(void)
                       &error_fatal);
 }
 
+/*
+ * Does this -netdev argument use modern rather than traditional syntax?
+ * Modern syntax is to be parsed with netdev_parse_modern().
+ * Traditional syntax is to be parsed with net_client_parse().
+ */
+bool netdev_is_modern(const char *optarg)
+{
+    return false;
+}
+
+/*
+ * netdev_parse_modern() uses modern, more expressive syntax than
+ * net_client_parse(), but supports only the -netdev option.
+ * netdev_parse_modern() appends to @nd_queue, whereas net_client_parse()
+ * appends to @qemu_netdev_opts.
+ */
+void netdev_parse_modern(const char *optarg)
+{
+    Visitor *v;
+    NetdevQueueEntry *nd;
+
+    v = qobject_input_visitor_new_str(optarg, "type", &error_fatal);
+    nd = g_new(NetdevQueueEntry, 1);
+    visit_type_Netdev(v, NULL, &nd->nd, &error_fatal);
+    visit_free(v);
+    loc_save(&nd->loc);
+
+    QSIMPLEQ_INSERT_TAIL(&nd_queue, nd, entry);
+}
+
 void net_client_parse(QemuOptsList *opts_list, const char *optarg)
 {
     if (!qemu_opts_parse_noisily(opts_list, optarg, true)) {
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ void qemu_init(int argc, char **argv)
                 break;
             case QEMU_OPTION_netdev:
                 default_net = 0;
-                net_client_parse(qemu_find_opts("netdev"), optarg);
+                if (netdev_is_modern(optarg)) {
+                    netdev_parse_modern(optarg);
+                } else {
+                    net_client_parse(qemu_find_opts("netdev"), optarg);
+                }
                 break;
             case QEMU_OPTION_nic:
                 default_net = 0;
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

Embed the setting of info_str in a function.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/xen_nic.c  |  5 ++---
 include/net/net.h |  1 +
 net/l2tpv3.c      |  3 +--
 net/net.c         | 17 ++++++++++++-----
 net/slirp.c       |  5 ++---
 net/socket.c      | 33 ++++++++++++++-------------------
 net/tap-win32.c   |  3 +--
 net/tap.c         | 13 +++++--------
 net/vde.c         |  3 +--
 net/vhost-user.c  |  3 +--
 net/vhost-vdpa.c  |  2 +-
 11 files changed, 41 insertions(+), 47 deletions(-)

diff --git a/hw/net/xen_nic.c b/hw/net/xen_nic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/xen_nic.c
+++ b/hw/net/xen_nic.c
@@ -XXX,XX +XXX,XX @@ static int net_init(struct XenLegacyDevice *xendev)
     netdev->nic = qemu_new_nic(&net_xen_info, &netdev->conf,
                                "xen", NULL, netdev);
 
-    snprintf(qemu_get_queue(netdev->nic)->info_str,
-             sizeof(qemu_get_queue(netdev->nic)->info_str),
-             "nic: xenbus vif macaddr=%s", netdev->mac);
+    qemu_set_info_str(qemu_get_queue(netdev->nic),
+                      "nic: xenbus vif macaddr=%s", netdev->mac);
 
     /* fill info */
     xenstore_write_be_int(&netdev->xendev, "feature-rx-copy", 1);
diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ ssize_t qemu_send_packet_async(NetClientState *nc, const uint8_t *buf,
 void qemu_purge_queued_packets(NetClientState *nc);
 void qemu_flush_queued_packets(NetClientState *nc);
 void qemu_flush_or_purge_queued_packets(NetClientState *nc, bool purge);
+void qemu_set_info_str(NetClientState *nc, const char *fmt, ...);
 void qemu_format_nic_info_str(NetClientState *nc, uint8_t macaddr[6]);
 bool qemu_has_ufo(NetClientState *nc);
 bool qemu_has_vnet_hdr(NetClientState *nc);
diff --git a/net/l2tpv3.c b/net/l2tpv3.c
index XXXXXXX..XXXXXXX 100644
--- a/net/l2tpv3.c
+++ b/net/l2tpv3.c
@@ -XXX,XX +XXX,XX @@ int net_init_l2tpv3(const Netdev *netdev,
 
     l2tpv3_read_poll(s, true);
 
-    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
-             "l2tpv3: connected");
+    qemu_set_info_str(&s->nc, "l2tpv3: connected");
     return 0;
 outerr:
     qemu_del_net_client(nc);
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ char *qemu_mac_strdup_printf(const uint8_t *macaddr)
                            macaddr[3], macaddr[4], macaddr[5]);
 }
 
+void qemu_set_info_str(NetClientState *nc, const char *fmt, ...)
+{
+    va_list ap;
+
+    va_start(ap, fmt);
+    vsnprintf(nc->info_str, sizeof(nc->info_str), fmt, ap);
+    va_end(ap);
+}
+
 void qemu_format_nic_info_str(NetClientState *nc, uint8_t macaddr[6])
 {
-    snprintf(nc->info_str, sizeof(nc->info_str),
-             "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
-             nc->model,
-             macaddr[0], macaddr[1], macaddr[2],
-             macaddr[3], macaddr[4], macaddr[5]);
+    qemu_set_info_str(nc, "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
+                      nc->model, macaddr[0], macaddr[1], macaddr[2],
+                      macaddr[3], macaddr[4], macaddr[5]);
 }
 
 static int mac_table[256] = {0};
diff --git a/net/slirp.c b/net/slirp.c
index XXXXXXX..XXXXXXX 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -XXX,XX +XXX,XX @@ static int net_slirp_init(NetClientState *peer, const char *model,
 
     nc = qemu_new_net_client(&net_slirp_info, peer, model, name);
 
-    snprintf(nc->info_str, sizeof(nc->info_str),
-             "net=%s,restrict=%s", inet_ntoa(net),
-             restricted ? "on" : "off");
+    qemu_set_info_str(nc, "net=%s,restrict=%s", inet_ntoa(net),
+                      restricted ? "on" : "off");
 
     s = DO_UPCAST(SlirpState, nc, nc);
 
diff --git a/net/socket.c b/net/socket.c
index XXXXXXX..XXXXXXX 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -XXX,XX +XXX,XX @@ static void net_socket_send(void *opaque)
         s->fd = -1;
         net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
         s->nc.link_down = true;
-        memset(s->nc.info_str, 0, sizeof(s->nc.info_str));
+        qemu_set_info_str(&s->nc, "");
 
         return;
     }
@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_dgram(NetClientState *peer,
     /* mcast: save bound address as dst */
     if (is_connected && mcast != NULL) {
         s->dgram_dst = saddr;
-        snprintf(nc->info_str, sizeof(nc->info_str),
-                 "socket: fd=%d (cloned mcast=%s:%d)",
-                 fd, inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+        qemu_set_info_str(nc, "socket: fd=%d (cloned mcast=%s:%d)", fd,
+                          inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
     } else {
         if (sa_type == SOCKET_ADDRESS_TYPE_UNIX) {
             s->dgram_dst.sin_family = AF_UNIX;
         }
 
-        snprintf(nc->info_str, sizeof(nc->info_str),
-                 "socket: fd=%d %s", fd, SocketAddressType_str(sa_type));
+        qemu_set_info_str(nc, "socket: fd=%d %s", fd,
+                          SocketAddressType_str(sa_type));
     }
 
     return s;
@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_stream(NetClientState *peer,
 
     nc = qemu_new_net_client(&net_socket_info, peer, model, name);
 
-    snprintf(nc->info_str, sizeof(nc->info_str), "socket: fd=%d", fd);
+    qemu_set_info_str(nc, "socket: fd=%d", fd);
 
     s = DO_UPCAST(NetSocketState, nc, nc);
 
@@ -XXX,XX +XXX,XX @@ static void net_socket_accept(void *opaque)
     s->fd = fd;
     s->nc.link_down = false;
     net_socket_connect(s);
-    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
-             "socket: connection from %s:%d",
-             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+    qemu_set_info_str(&s->nc, "socket: connection from %s:%d",
+                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
 }
 
 static int net_socket_listen_init(NetClientState *peer,
@@ -XXX,XX +XXX,XX @@ static int net_socket_connect_init(NetClientState *peer,
         return -1;
     }
 
-    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
-             "socket: connect to %s:%d",
-             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+    qemu_set_info_str(&s->nc, "socket: connect to %s:%d",
+                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static int net_socket_mcast_init(NetClientState *peer,
 
     s->dgram_dst = saddr;
 
-    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
-             "socket: mcast=%s:%d",
-             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+    qemu_set_info_str(&s->nc, "socket: mcast=%s:%d",
+                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
     return 0;
 
 }
@@ -XXX,XX +XXX,XX @@ static int net_socket_udp_init(NetClientState *peer,
 
     s->dgram_dst = raddr;
 
-    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
-             "socket: udp=%s:%d",
-             inet_ntoa(raddr.sin_addr), ntohs(raddr.sin_port));
+    qemu_set_info_str(&s->nc, "socket: udp=%s:%d", inet_ntoa(raddr.sin_addr),
+                      ntohs(raddr.sin_port));
     return 0;
 }
 
diff --git a/net/tap-win32.c b/net/tap-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -XXX,XX +XXX,XX @@ static int tap_win32_init(NetClientState *peer, const char *model,
 
     s = DO_UPCAST(TAPState, nc, nc);
 
-    snprintf(s->nc.info_str, sizeof(s->nc.info_str),
-             "tap: ifname=%s", ifname);
+    qemu_set_info_str(&s->nc, "tap: ifname=%s", ifname);
 
     s->handle = handle;
 
diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ int net_init_bridge(const Netdev *netdev, const char *name,
     }
     s = net_tap_fd_init(peer, "bridge", name, fd, vnet_hdr);
 
-    snprintf(s->nc.info_str, sizeof(s->nc.info_str), "helper=%s,br=%s", helper,
-             br);
+    qemu_set_info_str(&s->nc, "helper=%s,br=%s", helper, br);
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
     }
 
     if (tap->has_fd || tap->has_fds) {
-        snprintf(s->nc.info_str, sizeof(s->nc.info_str), "fd=%d", fd);
+        qemu_set_info_str(&s->nc, "fd=%d", fd);
     } else if (tap->has_helper) {
-        snprintf(s->nc.info_str, sizeof(s->nc.info_str), "helper=%s",
-                 tap->helper);
+        qemu_set_info_str(&s->nc, "helper=%s", tap->helper);
     } else {
-        snprintf(s->nc.info_str, sizeof(s->nc.info_str),
-                 "ifname=%s,script=%s,downscript=%s", ifname, script,
-                 downscript);
+        qemu_set_info_str(&s->nc, "ifname=%s,script=%s,downscript=%s", ifname,
+                          script, downscript);
 
         if (strcmp(downscript, "no") != 0) {
             snprintf(s->down_script, sizeof(s->down_script), "%s", downscript);
diff --git a/net/vde.c b/net/vde.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vde.c
+++ b/net/vde.c
@@ -XXX,XX +XXX,XX @@ static int net_vde_init(NetClientState *peer, const char *model,
 
     nc = qemu_new_net_client(&net_vde_info, peer, model, name);
 
-    snprintf(nc->info_str, sizeof(nc->info_str), "sock=%s,fd=%d",
-             sock, vde_datafd(vde));
+    qemu_set_info_str(nc, "sock=%s,fd=%d", sock, vde_datafd(vde));
 
     s = DO_UPCAST(VDEState, nc, nc);
 
diff --git a/net/vhost-user.c b/net/vhost-user.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -XXX,XX +XXX,XX @@ static int net_vhost_user_init(NetClientState *peer, const char *device,
     user = g_new0(struct VhostUserState, 1);
     for (i = 0; i < queues; i++) {
         nc = qemu_new_net_client(&net_vhost_user_info, peer, device, name);
-        snprintf(nc->info_str, sizeof(nc->info_str), "vhost-user%d to %s",
-                 i, chr->label);
+        qemu_set_info_str(nc, "vhost-user%d to %s", i, chr->label);
         nc->queue_index = i;
         if (!nc0) {
             nc0 = nc;
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
                                          device, name);
     }
-    snprintf(nc->info_str, sizeof(nc->info_str), TYPE_VHOST_VDPA);
+    qemu_set_info_str(nc, TYPE_VHOST_VDPA);
     s = DO_UPCAST(VhostVDPAState, nc, nc);
 
     s->vhost_vdpa.device_fd = vdpa_device_fd;
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

Copied from socket netdev file and modified to use SocketAddress
to be able to introduce new features like unix socket.

"udp" and "mcast" are squashed into dgram netdev, multicast is detected
according to the IP address type.
"listen" and "connect" modes are managed by stream netdev. An optional
parameter "server" defines the mode (off by default)

The two new types need to be parsed the modern way with -netdev, because
with the traditional way, the "type" field of netdev structure collides with
the "type" field of SocketAddress and prevents the correct evaluation of the
command line option. Moreover the traditional way doesn't allow to use
the same type (SocketAddress) several times with the -netdev option
(needed to specify "local" and "remote" addresses).

The previous commit paved the way for parsing the modern way, but
omitted one detail: how to pick modern vs. traditional, in
netdev_is_modern().

We want to pick based on the value of parameter "type".  But how to
extract it from the option argument?

Parsing the option argument, either the modern or the traditional way,
extracts it for us, but only if parsing succeeds.

If parsing fails, there is no good option.  No matter which parser we
pick, it'll be the wrong one for some arguments, and the error
reporting will be confusing.

Fortunately, the traditional parser accepts *anything* when called in
a certain way.  This maximizes our chance to extract the value of
"type", and in turn minimizes the risk of confusing error reporting.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hmp-commands.hx |   2 +-
 net/clients.h   |   6 +
 net/dgram.c     | 537 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 net/hub.c       |   2 +
 net/meson.build |   2 +
 net/net.c       |  30 +++-
 net/stream.c    | 425 ++++++++++++++++++++++++++++++++++++++++++++
 qapi/net.json   |  66 ++++++-
 qemu-options.hx |  12 ++
 9 files changed, 1078 insertions(+), 4 deletions(-)
 create mode 100644 net/dgram.c
 create mode 100644 net/stream.c

diff --git a/hmp-commands.hx b/hmp-commands.hx
index XXXXXXX..XXXXXXX 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -XXX,XX +XXX,XX @@ ERST
     {
         .name       = "netdev_add",
         .args_type  = "netdev:O",
-        .params     = "[user|tap|socket|vde|bridge|hubport|netmap|vhost-user"
+        .params     = "[user|tap|socket|stream|dgram|vde|bridge|hubport|netmap|vhost-user"
 #ifdef CONFIG_VMNET
                       "|vmnet-host|vmnet-shared|vmnet-bridged"
 #endif
diff --git a/net/clients.h b/net/clients.h
index XXXXXXX..XXXXXXX 100644
--- a/net/clients.h
+++ b/net/clients.h
@@ -XXX,XX +XXX,XX @@ int net_init_hubport(const Netdev *netdev, const char *name,
 int net_init_socket(const Netdev *netdev, const char *name,
                     NetClientState *peer, Error **errp);
 
+int net_init_stream(const Netdev *netdev, const char *name,
+                    NetClientState *peer, Error **errp);
+
+int net_init_dgram(const Netdev *netdev, const char *name,
+                   NetClientState *peer, Error **errp);
+
 int net_init_tap(const Netdev *netdev, const char *name,
                  NetClientState *peer, Error **errp);
 
diff --git a/net/dgram.c b/net/dgram.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/dgram.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU System Emulator
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2022 Red Hat, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+
+#include "net/net.h"
+#include "clients.h"
+#include "monitor/monitor.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/option.h"
+#include "qemu/sockets.h"
+#include "qemu/iov.h"
+#include "qemu/main-loop.h"
+#include "qemu/cutils.h"
+
+typedef struct NetDgramState {
+    NetClientState nc;
+    int fd;
+    SocketReadState rs;
+    struct sockaddr_in dgram_dst; /* contains destination iff connectionless */
+    bool read_poll;               /* waiting to receive data? */
+    bool write_poll;              /* waiting to transmit data? */
+} NetDgramState;
+
+static void net_dgram_send(void *opaque);
+static void net_dgram_writable(void *opaque);
+
+static void net_dgram_update_fd_handler(NetDgramState *s)
+{
+    qemu_set_fd_handler(s->fd,
+                        s->read_poll ? net_dgram_send : NULL,
+                        s->write_poll ? net_dgram_writable : NULL,
+                        s);
+}
+
+static void net_dgram_read_poll(NetDgramState *s, bool enable)
+{
+    s->read_poll = enable;
+    net_dgram_update_fd_handler(s);
+}
+
+static void net_dgram_write_poll(NetDgramState *s, bool enable)
+{
+    s->write_poll = enable;
+    net_dgram_update_fd_handler(s);
+}
+
+static void net_dgram_writable(void *opaque)
+{
+    NetDgramState *s = opaque;
+
+    net_dgram_write_poll(s, false);
+
+    qemu_flush_queued_packets(&s->nc);
+}
+
+static ssize_t net_dgram_receive(NetClientState *nc,
+                                 const uint8_t *buf, size_t size)
+{
+    NetDgramState *s = DO_UPCAST(NetDgramState, nc, nc);
+    ssize_t ret;
+
+    do {
+        if (s->dgram_dst.sin_family != AF_UNIX) {
+            ret = sendto(s->fd, buf, size, 0,
+                         (struct sockaddr *)&s->dgram_dst,
+                         sizeof(s->dgram_dst));
+        } else {
+            ret = send(s->fd, buf, size, 0);
+        }
+    } while (ret == -1 && errno == EINTR);
+
+    if (ret == -1 && errno == EAGAIN) {
+        net_dgram_write_poll(s, true);
+        return 0;
+    }
+    return ret;
+}
+
+static void net_dgram_send_completed(NetClientState *nc, ssize_t len)
+{
+    NetDgramState *s = DO_UPCAST(NetDgramState, nc, nc);
+
+    if (!s->read_poll) {
+        net_dgram_read_poll(s, true);
+    }
+}
+
+static void net_dgram_rs_finalize(SocketReadState *rs)
+{
+    NetDgramState *s = container_of(rs, NetDgramState, rs);
+
+    if (qemu_send_packet_async(&s->nc, rs->buf,
+                               rs->packet_len,
+                               net_dgram_send_completed) == 0) {
+        net_dgram_read_poll(s, false);
+    }
+}
+
+static void net_dgram_send(void *opaque)
+{
+    NetDgramState *s = opaque;
+    int size;
+
+    size = recv(s->fd, s->rs.buf, sizeof(s->rs.buf), 0);
+    if (size < 0) {
+        return;
+    }
+    if (size == 0) {
+        /* end of connection */
+        net_dgram_read_poll(s, false);
+        net_dgram_write_poll(s, false);
+        return;
+    }
+    if (qemu_send_packet_async(&s->nc, s->rs.buf, size,
+                               net_dgram_send_completed) == 0) {
+        net_dgram_read_poll(s, false);
+    }
+}
+
+static int net_dgram_mcast_create(struct sockaddr_in *mcastaddr,
+                                  struct in_addr *localaddr,
+                                  Error **errp)
+{
+    struct ip_mreq imr;
+    int fd;
+    int val, ret;
+#ifdef __OpenBSD__
+    unsigned char loop;
+#else
+    int loop;
+#endif
+
+    if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
+        error_setg(errp, "specified mcastaddr %s (0x%08x) "
+                   "does not contain a multicast address",
+                   inet_ntoa(mcastaddr->sin_addr),
+                   (int)ntohl(mcastaddr->sin_addr.s_addr));
+        return -1;
+    }
+
+    fd = qemu_socket(PF_INET, SOCK_DGRAM, 0);
+    if (fd < 0) {
+        error_setg_errno(errp, errno, "can't create datagram socket");
+        return -1;
+    }
+
+    /*
+     * Allow multiple sockets to bind the same multicast ip and port by setting
+     * SO_REUSEADDR. This is the only situation where SO_REUSEADDR should be set
+     * on windows. Use socket_set_fast_reuse otherwise as it sets SO_REUSEADDR
+     * only on posix systems.
+     */
+    val = 1;
+    ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val));
+    if (ret < 0) {
+        error_setg_errno(errp, errno, "can't set socket option SO_REUSEADDR");
+        goto fail;
+    }
+
+    ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
+    if (ret < 0) {
+        error_setg_errno(errp, errno, "can't bind ip=%s to socket",
+                         inet_ntoa(mcastaddr->sin_addr));
+        goto fail;
+    }
+
+    /* Add host to multicast group */
+    imr.imr_multiaddr = mcastaddr->sin_addr;
+    if (localaddr) {
+        imr.imr_interface = *localaddr;
+    } else {
+        imr.imr_interface.s_addr = htonl(INADDR_ANY);
+    }
+
+    ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
+                     &imr, sizeof(struct ip_mreq));
+    if (ret < 0) {
+        error_setg_errno(errp, errno,
+                         "can't add socket to multicast group %s",
+                         inet_ntoa(imr.imr_multiaddr));
+        goto fail;
+    }
+
+    /* Force mcast msgs to loopback (eg. several QEMUs in same host */
+    loop = 1;
+    ret = setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
+                     &loop, sizeof(loop));
+    if (ret < 0) {
+        error_setg_errno(errp, errno,
+                         "can't force multicast message to loopback");
+        goto fail;
+    }
+
+    /* If a bind address is given, only send packets from that address */
+    if (localaddr != NULL) {
+        ret = setsockopt(fd, IPPROTO_IP, IP_MULTICAST_IF,
+                         localaddr, sizeof(*localaddr));
+        if (ret < 0) {
+            error_setg_errno(errp, errno,
+                             "can't set the default network send interface");
+            goto fail;
+        }
+    }
+
+    qemu_socket_set_nonblock(fd);
+    return fd;
+fail:
+    if (fd >= 0) {
+        closesocket(fd);
+    }
+    return -1;
+}
+
+static void net_dgram_cleanup(NetClientState *nc)
+{
+    NetDgramState *s = DO_UPCAST(NetDgramState, nc, nc);
+    if (s->fd != -1) {
+        net_dgram_read_poll(s, false);
+        net_dgram_write_poll(s, false);
+        close(s->fd);
+        s->fd = -1;
+    }
+}
+
+static NetClientInfo net_dgram_socket_info = {
+    .type = NET_CLIENT_DRIVER_DGRAM,
+    .size = sizeof(NetDgramState),
+    .receive = net_dgram_receive,
+    .cleanup = net_dgram_cleanup,
+};
+
+static NetDgramState *net_dgram_fd_init(NetClientState *peer,
+                                        const char *model,
+                                        const char *name,
+                                        int fd, int is_fd,
+                                        SocketAddress *mcast,
+                                        Error **errp)
+{
+    struct sockaddr_in saddr;
+    int newfd;
+    NetClientState *nc;
+    NetDgramState *s;
+    SocketAddress *sa;
+    SocketAddressType sa_type;
+
+    sa = socket_local_address(fd, errp);
+    if (!sa) {
+        return NULL;
+    }
+    sa_type = sa->type;
+    qapi_free_SocketAddress(sa);
+
+    /*
+     * fd passed: multicast: "learn" dgram_dst address from bound address and
+     * save it. Because this may be "shared" socket from a "master" process,
+     * datagrams would be recv() by ONLY ONE process: we must "clone" this
+     * dgram socket --jjo
+     */
+
+    if (is_fd && mcast != NULL) {
+            if (convert_host_port(&saddr, mcast->u.inet.host,
+                                  mcast->u.inet.port, errp) < 0) {
+                goto err;
+            }
+            /* must be bound */
+            if (saddr.sin_addr.s_addr == 0) {
+                error_setg(errp, "can't setup multicast destination address");
+                goto err;
+            }
+            /* clone dgram socket */
+            newfd = net_dgram_mcast_create(&saddr, NULL, errp);
+            if (newfd < 0) {
+                goto err;
+            }
+            /* clone newfd to fd, close newfd */
+            dup2(newfd, fd);
+            close(newfd);
+
+    }
+
+    nc = qemu_new_net_client(&net_dgram_socket_info, peer, model, name);
+
+    s = DO_UPCAST(NetDgramState, nc, nc);
+
+    s->fd = fd;
+    net_socket_rs_init(&s->rs, net_dgram_rs_finalize, false);
+    net_dgram_read_poll(s, true);
+
+    /* mcast: save bound address as dst */
+    if (is_fd && mcast != NULL) {
+        s->dgram_dst = saddr;
+        qemu_set_info_str(nc, "fd=%d (cloned mcast=%s:%d)", fd,
+                          inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+    } else {
+        if (sa_type == SOCKET_ADDRESS_TYPE_UNIX) {
+            s->dgram_dst.sin_family = AF_UNIX;
+        }
+
+        qemu_set_info_str(nc, "fd=%d %s", fd, SocketAddressType_str(sa_type));
+    }
+
+    return s;
+
+err:
+    closesocket(fd);
+    return NULL;
+}
+
+static int net_dgram_mcast_init(NetClientState *peer,
+                                const char *model,
+                                const char *name,
+                                SocketAddress *remote,
+                                SocketAddress *local,
+                                Error **errp)
+{
+    NetDgramState *s;
+    int fd, ret;
+    struct sockaddr_in saddr;
+
+    if (remote->type != SOCKET_ADDRESS_TYPE_INET) {
+        error_setg(errp, "multicast only support inet type");
+        return -1;
+    }
+
+    if (convert_host_port(&saddr, remote->u.inet.host, remote->u.inet.port,
+                          errp) < 0) {
+        return -1;
+    }
+
+    if (!local) {
+        fd = net_dgram_mcast_create(&saddr, NULL, errp);
+        if (fd < 0) {
+            return -1;
+        }
+    } else {
+        switch (local->type) {
+        case SOCKET_ADDRESS_TYPE_INET: {
+            struct in_addr localaddr;
+
+            if (inet_aton(local->u.inet.host, &localaddr) == 0) {
+                error_setg(errp, "localaddr '%s' is not a valid IPv4 address",
+                           local->u.inet.host);
+                return -1;
+            }
+
+            fd = net_dgram_mcast_create(&saddr, &localaddr, errp);
+            if (fd < 0) {
+                return -1;
+            }
+            break;
+        }
+        case SOCKET_ADDRESS_TYPE_FD:
+            fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
+            if (fd == -1) {
+                return -1;
+            }
+            ret = qemu_socket_try_set_nonblock(fd);
+            if (ret < 0) {
+                error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
+                                 name, fd);
+                return -1;
+            }
+            break;
+        default:
+            error_setg(errp, "only support inet or fd type for local");
+            return -1;
+        }
+    }
+
+    s = net_dgram_fd_init(peer, model, name, fd,
+                          local->type == SOCKET_ADDRESS_TYPE_FD,
+                          remote, errp);
+    if (!s) {
+        return -1;
+    }
+
+    s->dgram_dst = saddr;
+
+    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr.sin_addr),
+                      ntohs(saddr.sin_port));
+    return 0;
+
+}
+
+
+int net_init_dgram(const Netdev *netdev, const char *name,
+                   NetClientState *peer, Error **errp)
+{
+    NetDgramState *s;
+    int fd, ret;
+    struct sockaddr_in raddr_in;
+    struct sockaddr_in laddr_in;
+    SocketAddress *remote, *local;
+
+    assert(netdev->type == NET_CLIENT_DRIVER_DGRAM);
+
+    remote = netdev->u.dgram.remote;
+    local = netdev->u.dgram.local;
+
+    /* detect multicast address */
+    if (remote && remote->type == SOCKET_ADDRESS_TYPE_INET) {
+        struct sockaddr_in mcastaddr;
+
+        if (convert_host_port(&mcastaddr, remote->u.inet.host,
+                              remote->u.inet.port, errp) < 0) {
+            return -1;
+        }
+
+        if (IN_MULTICAST(ntohl(mcastaddr.sin_addr.s_addr))) {
+            return net_dgram_mcast_init(peer, "dram", name, remote, local,
+                                           errp);
+        }
+    }
+
+    /* unicast address */
+    if (!local) {
+        error_setg(errp, "dgram requires local= parameter");
+        return -1;
+    }
+
+    if (remote) {
+        if (local->type == SOCKET_ADDRESS_TYPE_FD) {
+            error_setg(errp, "don't set remote with local.fd");
+            return -1;
+        }
+        if (remote->type != local->type) {
+            error_setg(errp, "remote and local types must be the same");
+            return -1;
+        }
+    } else {
+        if (local->type != SOCKET_ADDRESS_TYPE_FD) {
+            error_setg(errp, "type=inet requires remote parameter");
+            return -1;
+        }
+    }
+
+    switch (local->type) {
+    case SOCKET_ADDRESS_TYPE_INET:
+        if (convert_host_port(&laddr_in, local->u.inet.host, local->u.inet.port,
+                              errp) < 0) {
+            return -1;
+        }
+
+        if (convert_host_port(&raddr_in, remote->u.inet.host,
+                              remote->u.inet.port, errp) < 0) {
+            return -1;
+        }
+
+        fd = qemu_socket(PF_INET, SOCK_DGRAM, 0);
+        if (fd < 0) {
+            error_setg_errno(errp, errno, "can't create datagram socket");
+            return -1;
+        }
+
+        ret = socket_set_fast_reuse(fd);
+        if (ret < 0) {
+            error_setg_errno(errp, errno,
+                             "can't set socket option SO_REUSEADDR");
+            closesocket(fd);
+            return -1;
+        }
+        ret = bind(fd, (struct sockaddr *)&laddr_in, sizeof(laddr_in));
+        if (ret < 0) {
+            error_setg_errno(errp, errno, "can't bind ip=%s to socket",
+                             inet_ntoa(laddr_in.sin_addr));
+            closesocket(fd);
+            return -1;
+        }
+        qemu_socket_set_nonblock(fd);
+        break;
+    case SOCKET_ADDRESS_TYPE_FD:
+        fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
+        if (fd == -1) {
+            return -1;
+        }
+        ret = qemu_socket_try_set_nonblock(fd);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
+                             name, fd);
+            return -1;
+        }
+        break;
+    default:
+        error_setg(errp, "only support inet or fd type for local");
+        return -1;
+    }
+
+    s = net_dgram_fd_init(peer, "dgram", name, fd, 0, NULL, errp);
+    if (!s) {
+        return -1;
+    }
+
+    if (remote) {
+        s->dgram_dst = raddr_in;
+    }
+
+    switch (local->type) {
+    case SOCKET_ADDRESS_TYPE_INET:
+        qemu_set_info_str(&s->nc, "udp=%s:%d/%s:%d",
+                          inet_ntoa(laddr_in.sin_addr),
+                          ntohs(laddr_in.sin_port),
+                          inet_ntoa(raddr_in.sin_addr),
+                          ntohs(raddr_in.sin_port));
+        break;
+    case SOCKET_ADDRESS_TYPE_FD:
+        qemu_set_info_str(&s->nc, "fd=%d", fd);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    return 0;
+}
diff --git a/net/hub.c b/net/hub.c
index XXXXXXX..XXXXXXX 100644
--- a/net/hub.c
+++ b/net/hub.c
@@ -XXX,XX +XXX,XX @@ void net_hub_check_clients(void)
             case NET_CLIENT_DRIVER_USER:
             case NET_CLIENT_DRIVER_TAP:
             case NET_CLIENT_DRIVER_SOCKET:
+            case NET_CLIENT_DRIVER_STREAM:
+            case NET_CLIENT_DRIVER_DGRAM:
             case NET_CLIENT_DRIVER_VDE:
             case NET_CLIENT_DRIVER_VHOST_USER:
                 has_host_dev = 1;
diff --git a/net/meson.build b/net/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/net/meson.build
+++ b/net/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(files(
   'net.c',
   'queue.c',
   'socket.c',
+  'stream.c',
+  'dgram.c',
   'util.c',
 ))
 
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/qemu-print.h"
 #include "qemu/main-loop.h"
 #include "qemu/option.h"
+#include "qemu/keyval.h"
 #include "qapi/error.h"
 #include "qapi/opts-visitor.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
 #endif
         [NET_CLIENT_DRIVER_TAP]       = net_init_tap,
         [NET_CLIENT_DRIVER_SOCKET]    = net_init_socket,
+        [NET_CLIENT_DRIVER_STREAM]    = net_init_stream,
+        [NET_CLIENT_DRIVER_DGRAM]     = net_init_dgram,
 #ifdef CONFIG_VDE
         [NET_CLIENT_DRIVER_VDE]       = net_init_vde,
 #endif
@@ -XXX,XX +XXX,XX @@ void show_netdevs(void)
     int idx;
     const char *available_netdevs[] = {
         "socket",
+        "stream",
+        "dgram",
         "hubport",
         "tap",
 #ifdef CONFIG_SLIRP
@@ -XXX,XX +XXX,XX @@ void net_init_clients(void)
  */
 bool netdev_is_modern(const char *optarg)
 {
-    return false;
+    QemuOpts *opts;
+    bool is_modern;
+    const char *type;
+    static QemuOptsList dummy_opts = {
+        .name = "netdev",
+        .implied_opt_name = "type",
+        .head = QTAILQ_HEAD_INITIALIZER(dummy_opts.head),
+        .desc = { { } },
+    };
+
+    if (optarg[0] == '{') {
+        /* This is JSON, which means it's modern syntax */
+        return true;
+    }
+
+    opts = qemu_opts_create(&dummy_opts, NULL, false, &error_abort);
+    qemu_opts_do_parse(opts, optarg, dummy_opts.implied_opt_name,
+                       &error_abort);
+    type = qemu_opt_get(opts, "type");
+    is_modern = !g_strcmp0(type, "stream") || !g_strcmp0(type, "dgram");
+
+    qemu_opts_reset(&dummy_opts);
+
+    return is_modern;
 }
 
 /*
diff --git a/net/stream.c b/net/stream.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/stream.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU System Emulator
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ * Copyright (c) 2022 Red Hat, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+
+#include "net/net.h"
+#include "clients.h"
+#include "monitor/monitor.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/option.h"
+#include "qemu/sockets.h"
+#include "qemu/iov.h"
+#include "qemu/main-loop.h"
+#include "qemu/cutils.h"
+
+typedef struct NetStreamState {
+    NetClientState nc;
+    int listen_fd;
+    int fd;
+    SocketReadState rs;
+    unsigned int send_index;      /* number of bytes sent*/
+    bool read_poll;               /* waiting to receive data? */
+    bool write_poll;              /* waiting to transmit data? */
+} NetStreamState;
+
+static void net_stream_send(void *opaque);
+static void net_stream_accept(void *opaque);
+static void net_stream_writable(void *opaque);
+
+static void net_stream_update_fd_handler(NetStreamState *s)
+{
+    qemu_set_fd_handler(s->fd,
+                        s->read_poll ? net_stream_send : NULL,
+                        s->write_poll ? net_stream_writable : NULL,
+                        s);
+}
+
+static void net_stream_read_poll(NetStreamState *s, bool enable)
+{
+    s->read_poll = enable;
+    net_stream_update_fd_handler(s);
+}
+
+static void net_stream_write_poll(NetStreamState *s, bool enable)
+{
+    s->write_poll = enable;
+    net_stream_update_fd_handler(s);
+}
+
+static void net_stream_writable(void *opaque)
+{
+    NetStreamState *s = opaque;
+
+    net_stream_write_poll(s, false);
+
+    qemu_flush_queued_packets(&s->nc);
+}
+
+static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
+                                  size_t size)
+{
+    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
+    uint32_t len = htonl(size);
+    struct iovec iov[] = {
+        {
+            .iov_base = &len,
+            .iov_len  = sizeof(len),
+        }, {
+            .iov_base = (void *)buf,
+            .iov_len  = size,
+        },
+    };
+    size_t remaining;
+    ssize_t ret;
+
+    remaining = iov_size(iov, 2) - s->send_index;
+    ret = iov_send(s->fd, iov, 2, s->send_index, remaining);
+
+    if (ret == -1 && errno == EAGAIN) {
+        ret = 0; /* handled further down */
+    }
+    if (ret == -1) {
+        s->send_index = 0;
+        return -errno;
+    }
+    if (ret < (ssize_t)remaining) {
+        s->send_index += ret;
+        net_stream_write_poll(s, true);
+        return 0;
+    }
+    s->send_index = 0;
+    return size;
+}
+
+static void net_stream_send_completed(NetClientState *nc, ssize_t len)
+{
+    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
+
+    if (!s->read_poll) {
+        net_stream_read_poll(s, true);
+    }
+}
+
+static void net_stream_rs_finalize(SocketReadState *rs)
+{
+    NetStreamState *s = container_of(rs, NetStreamState, rs);
+
+    if (qemu_send_packet_async(&s->nc, rs->buf,
+                               rs->packet_len,
+                               net_stream_send_completed) == 0) {
+        net_stream_read_poll(s, false);
+    }
+}
+
+static void net_stream_send(void *opaque)
+{
+    NetStreamState *s = opaque;
+    int size;
+    int ret;
+    uint8_t buf1[NET_BUFSIZE];
+    const uint8_t *buf;
+
+    size = recv(s->fd, buf1, sizeof(buf1), 0);
+    if (size < 0) {
+        if (errno != EWOULDBLOCK) {
+            goto eoc;
+        }
+    } else if (size == 0) {
+        /* end of connection */
+    eoc:
+        net_stream_read_poll(s, false);
+        net_stream_write_poll(s, false);
+        if (s->listen_fd != -1) {
+            qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
+        }
+        closesocket(s->fd);
+
+        s->fd = -1;
+        net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
+        s->nc.link_down = true;
+        qemu_set_info_str(&s->nc, "");
+
+        return;
+    }
+    buf = buf1;
+
+    ret = net_fill_rstate(&s->rs, buf, size);
+
+    if (ret == -1) {
+        goto eoc;
+    }
+}
+
+static void net_stream_cleanup(NetClientState *nc)
+{
+    NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
+    if (s->fd != -1) {
+        net_stream_read_poll(s, false);
+        net_stream_write_poll(s, false);
+        close(s->fd);
+        s->fd = -1;
+    }
+    if (s->listen_fd != -1) {
+        qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
+        closesocket(s->listen_fd);
+        s->listen_fd = -1;
+    }
+}
+
+static void net_stream_connect(void *opaque)
+{
+    NetStreamState *s = opaque;
+    net_stream_read_poll(s, true);
+}
+
+static NetClientInfo net_stream_info = {
+    .type = NET_CLIENT_DRIVER_STREAM,
+    .size = sizeof(NetStreamState),
+    .receive = net_stream_receive,
+    .cleanup = net_stream_cleanup,
+};
+
+static NetStreamState *net_stream_fd_init(NetClientState *peer,
+                                          const char *model,
+                                          const char *name,
+                                          int fd, int is_connected)
+{
+    NetClientState *nc;
+    NetStreamState *s;
+
+    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
+
+    qemu_set_info_str(nc, "fd=%d", fd);
+
+    s = DO_UPCAST(NetStreamState, nc, nc);
+
+    s->fd = fd;
+    s->listen_fd = -1;
+    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
+
+    /* Disable Nagle algorithm on TCP sockets to reduce latency */
+    socket_set_nodelay(fd);
+
+    if (is_connected) {
+        net_stream_connect(s);
+    } else {
+        qemu_set_fd_handler(s->fd, NULL, net_stream_connect, s);
+    }
+    return s;
+}
+
+static void net_stream_accept(void *opaque)
+{
+    NetStreamState *s = opaque;
+    struct sockaddr_in saddr;
+    socklen_t len;
+    int fd;
+
+    for (;;) {
+        len = sizeof(saddr);
+        fd = qemu_accept(s->listen_fd, (struct sockaddr *)&saddr, &len);
+        if (fd < 0 && errno != EINTR) {
+            return;
+        } else if (fd >= 0) {
+            qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
+            break;
+        }
+    }
+
+    s->fd = fd;
+    s->nc.link_down = false;
+    net_stream_connect(s);
+    qemu_set_info_str(&s->nc, "connection from %s:%d",
+                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+}
+
+static int net_stream_server_init(NetClientState *peer,
+                                  const char *model,
+                                  const char *name,
+                                  SocketAddress *addr,
+                                  Error **errp)
+{
+    NetClientState *nc;
+    NetStreamState *s;
+    int fd, ret;
+
+    switch (addr->type) {
+    case SOCKET_ADDRESS_TYPE_INET: {
+        struct sockaddr_in saddr_in;
+
+        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
+                              errp) < 0) {
+            return -1;
+        }
+
+        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
+        if (fd < 0) {
+            error_setg_errno(errp, errno, "can't create stream socket");
+            return -1;
+        }
+        qemu_socket_set_nonblock(fd);
+
+        socket_set_fast_reuse(fd);
+
+        ret = bind(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
+        if (ret < 0) {
+            error_setg_errno(errp, errno, "can't bind ip=%s to socket",
+                             inet_ntoa(saddr_in.sin_addr));
+            closesocket(fd);
+            return -1;
+        }
+        break;
+    }
+    case SOCKET_ADDRESS_TYPE_FD:
+        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
+        if (fd == -1) {
+            return -1;
+        }
+        ret = qemu_socket_try_set_nonblock(fd);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
+                             name, fd);
+            return -1;
+        }
+        break;
+    default:
+        error_setg(errp, "only support inet or fd type");
+        return -1;
+    }
+
+    ret = listen(fd, 0);
+    if (ret < 0) {
+        error_setg_errno(errp, errno, "can't listen on socket");
+        closesocket(fd);
+        return -1;
+    }
+
+    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
+    s = DO_UPCAST(NetStreamState, nc, nc);
+    s->fd = -1;
+    s->listen_fd = fd;
+    s->nc.link_down = true;
+    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
+
+    qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
+    return 0;
+}
+
+static int net_stream_client_init(NetClientState *peer,
+                                  const char *model,
+                                  const char *name,
+                                  SocketAddress *addr,
+                                  Error **errp)
+{
+    NetStreamState *s;
+    struct sockaddr_in saddr_in;
+    int fd, connected, ret;
+
+    switch (addr->type) {
+    case SOCKET_ADDRESS_TYPE_INET:
+        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
+                              errp) < 0) {
+            return -1;
+        }
+
+        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
+        if (fd < 0) {
+            error_setg_errno(errp, errno, "can't create stream socket");
+            return -1;
+        }
+        qemu_socket_set_nonblock(fd);
+
+        connected = 0;
+        for (;;) {
+            ret = connect(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
+            if (ret < 0) {
+                if (errno == EINTR || errno == EWOULDBLOCK) {
+                    /* continue */
+                } else if (errno == EINPROGRESS ||
+                           errno == EALREADY ||
+                           errno == EINVAL) {
+                    break;
+                } else {
+                    error_setg_errno(errp, errno, "can't connect socket");
+                    closesocket(fd);
+                    return -1;
+                }
+            } else {
+                connected = 1;
+                break;
+            }
+        }
+        break;
+    case SOCKET_ADDRESS_TYPE_FD:
+        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
+        if (fd == -1) {
+            return -1;
+        }
+        ret = qemu_socket_try_set_nonblock(fd);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
+                             name, fd);
+            return -1;
+        }
+        connected = 1;
+        break;
+    default:
+        error_setg(errp, "only support inet or fd type");
+        return -1;
+    }
+
+    s = net_stream_fd_init(peer, model, name, fd, connected);
+
+    switch (addr->type) {
+    case SOCKET_ADDRESS_TYPE_INET:
+        qemu_set_info_str(&s->nc, "connect to %s:%d",
+                          inet_ntoa(saddr_in.sin_addr),
+                          ntohs(saddr_in.sin_port));
+        break;
+    case SOCKET_ADDRESS_TYPE_FD:
+        qemu_set_info_str(&s->nc, "connect to fd %d", fd);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    return 0;
+}
+
+int net_init_stream(const Netdev *netdev, const char *name,
+                    NetClientState *peer, Error **errp)
+{
+    const NetdevStreamOptions *sock;
+
+    assert(netdev->type == NET_CLIENT_DRIVER_STREAM);
+    sock = &netdev->u.stream;
+
+    if (!sock->has_server || !sock->server) {
+        return net_stream_client_init(peer, "stream", name, sock->addr, errp);
+    }
+    return net_stream_server_init(peer, "stream", name, sock->addr, errp);
+}
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 ##
 
 { 'include': 'common.json' }
+{ 'include': 'sockets.json' }
 
 ##
 # @set_link:
@@ -XXX,XX +XXX,XX @@
   'if': 'CONFIG_VMNET' }
 
 ##
+# @NetdevStreamOptions:
+#
+# Configuration info for stream socket netdev
+#
+# @addr: socket address to listen on (server=true)
+#        or connect to (server=false)
+# @server: create server socket (default: false)
+#
+# Only SocketAddress types 'inet' and 'fd' are supported.
+#
+# Since: 7.2
+##
+{ 'struct': 'NetdevStreamOptions',
+  'data': {
+    'addr':   'SocketAddress',
+    '*server': 'bool' } }
+
+##
+# @NetdevDgramOptions:
+#
+# Configuration info for datagram socket netdev.
+#
+# @remote: remote address
+# @local: local address
+#
+# Only SocketAddress types 'inet' and 'fd' are supported.
+#
+# If remote address is present and it's a multicast address, local address
+# is optional. Otherwise local address is required and remote address is
+# optional.
+#
+# .. table:: Valid parameters combination table
+#    :widths: auto
+#
+#    =============  ========  =====
+#    remote         local     okay?
+#    =============  ========  =====
+#    absent         absent    no
+#    absent         not fd    no
+#    absent         fd        yes
+#    multicast      absent    yes
+#    multicast      present   yes
+#    not multicast  absent    no
+#    not multicast  present   yes
+#    =============  ========  =====
+#
+# Since: 7.2
+##
+{ 'struct': 'NetdevDgramOptions',
+  'data': {
+    '*local':  'SocketAddress',
+    '*remote': 'SocketAddress' } }
+
+##
 # @NetClientDriver:
 #
 # Available netdev drivers.
@@ -XXX,XX +XXX,XX @@
 #        @vmnet-host since 7.1
 #        @vmnet-shared since 7.1
 #        @vmnet-bridged since 7.1
+#        @stream since 7.2
+#        @dgram since 7.2
 ##
 { 'enum': 'NetClientDriver',
-  'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
-            'bridge', 'hubport', 'netmap', 'vhost-user', 'vhost-vdpa',
+  'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'stream',
+            'dgram', 'vde', 'bridge', 'hubport', 'netmap', 'vhost-user',
+            'vhost-vdpa',
             { 'name': 'vmnet-host', 'if': 'CONFIG_VMNET' },
             { 'name': 'vmnet-shared', 'if': 'CONFIG_VMNET' },
             { 'name': 'vmnet-bridged', 'if': 'CONFIG_VMNET' }] }
@@ -XXX,XX +XXX,XX @@
 #        'vmnet-host' - since 7.1
 #        'vmnet-shared' - since 7.1
 #        'vmnet-bridged' - since 7.1
+#        'stream' since 7.2
+#        'dgram' since 7.2
 ##
 { 'union': 'Netdev',
   'base': { 'id': 'str', 'type': 'NetClientDriver' },
@@ -XXX,XX +XXX,XX @@
     'tap':      'NetdevTapOptions',
     'l2tpv3':   'NetdevL2TPv3Options',
     'socket':   'NetdevSocketOptions',
+    'stream':   'NetdevStreamOptions',
+    'dgram':    'NetdevDgramOptions',
     'vde':      'NetdevVdeOptions',
     'bridge':   'NetdevBridgeOptions',
     'hubport':  'NetdevHubPortOptions',
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]\n"
     "                configure a network backend to connect to another network\n"
     "                using an UDP tunnel\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
+    "                configure a network backend to connect to another network\n"
+    "                using a socket connection in stream mode.\n"
+    "-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]\n"
+    "-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=fd,local.str=file-descriptor]\n"
+    "                configure a network backend to connect to a multicast maddr and port\n"
+    "                use ``local.host=addr`` to specify the host address to send packets from\n"
+    "-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]\n"
+    "-netdev dgram,id=str,local.type=fd,local.str=file-descriptor\n"
+    "                configure a network backend to connect to another network\n"
+    "                using an UDP tunnel\n"
 #ifdef CONFIG_VDE
     "-netdev vde,id=str[,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]\n"
     "                configure a network backend to connect to port 'n' of a vde switch\n"
-- 
2.7.4

From: Stefano Brivio <sbrivio@redhat.com>

Other errors are treated as failure by net_socket_connect_init(),
but if connect() returns EINVAL, we'll fail silently. Remove the
related exception.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/socket.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index XXXXXXX..XXXXXXX 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -XXX,XX +XXX,XX @@ static int net_socket_connect_init(NetClientState *peer,
             if (errno == EINTR || errno == EWOULDBLOCK) {
                 /* continue */
             } else if (errno == EINPROGRESS ||
-                       errno == EALREADY ||
-                       errno == EINVAL) {
+                       errno == EALREADY) {
                 break;
             } else {
                 error_setg_errno(errp, errno, "can't connect socket");
-- 
2.7.4

From: Stefano Brivio <sbrivio@redhat.com>

Other errors are treated as failure by net_stream_client_init(),
but if connect() returns EINVAL, we'll fail silently. Remove the
related exception.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
[lvivier: applied to net/stream.c]
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/stream.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/stream.c b/net/stream.c
index XXXXXXX..XXXXXXX 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
                 if (errno == EINTR || errno == EWOULDBLOCK) {
                     /* continue */
                 } else if (errno == EINPROGRESS ||
-                           errno == EALREADY ||
-                           errno == EINVAL) {
+                           errno == EALREADY) {
                     break;
                 } else {
                     error_setg_errno(errp, errno, "can't connect socket");
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com> (QAPI schema)
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/stream.c    | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++++---
 qapi/net.json   |   2 +-
 qemu-options.hx |   1 +
 3 files changed, 104 insertions(+), 6 deletions(-)

diff --git a/net/stream.c b/net/stream.c
index XXXXXXX..XXXXXXX 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -XXX,XX +XXX,XX @@ static NetStreamState *net_stream_fd_init(NetClientState *peer,
 static void net_stream_accept(void *opaque)
 {
     NetStreamState *s = opaque;
-    struct sockaddr_in saddr;
+    struct sockaddr_storage saddr;
     socklen_t len;
     int fd;
 
@@ -XXX,XX +XXX,XX @@ static void net_stream_accept(void *opaque)
     s->fd = fd;
     s->nc.link_down = false;
     net_stream_connect(s);
-    qemu_set_info_str(&s->nc, "connection from %s:%d",
-                      inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+    switch (saddr.ss_family) {
+    case AF_INET: {
+        struct sockaddr_in *saddr_in = (struct sockaddr_in *)&saddr;
+
+        qemu_set_info_str(&s->nc, "connection from %s:%d",
+                          inet_ntoa(saddr_in->sin_addr),
+                          ntohs(saddr_in->sin_port));
+        break;
+    }
+    case AF_UNIX: {
+        struct sockaddr_un saddr_un;
+
+        len = sizeof(saddr_un);
+        getsockname(s->listen_fd, (struct sockaddr *)&saddr_un, &len);
+        qemu_set_info_str(&s->nc, "connect from %s", saddr_un.sun_path);
+        break;
+    }
+    default:
+        g_assert_not_reached();
+    }
 }
 
 static int net_stream_server_init(NetClientState *peer,
@@ -XXX,XX +XXX,XX @@ static int net_stream_server_init(NetClientState *peer,
         }
         break;
     }
+    case SOCKET_ADDRESS_TYPE_UNIX: {
+        struct sockaddr_un saddr_un;
+
+        ret = unlink(addr->u.q_unix.path);
+        if (ret < 0 && errno != ENOENT) {
+            error_setg_errno(errp, errno, "failed to unlink socket %s",
+                             addr->u.q_unix.path);
+            return -1;
+        }
+
+        saddr_un.sun_family = PF_UNIX;
+        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
+                       addr->u.q_unix.path);
+        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
+            error_setg(errp, "UNIX socket path '%s' is too long",
+                       addr->u.q_unix.path);
+            error_append_hint(errp, "Path must be less than %zu bytes\n",
+                              sizeof(saddr_un.sun_path));
+            return -1;
+        }
+
+        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
+        if (fd < 0) {
+            error_setg_errno(errp, errno, "can't create stream socket");
+            return -1;
+        }
+        qemu_socket_set_nonblock(fd);
+
+        ret = bind(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
+        if (ret < 0) {
+            error_setg_errno(errp, errno, "can't create socket with path: %s",
+                             saddr_un.sun_path);
+            closesocket(fd);
+            return -1;
+        }
+        break;
+    }
     case SOCKET_ADDRESS_TYPE_FD:
         fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
         if (fd == -1) {
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
 {
     NetStreamState *s;
     struct sockaddr_in saddr_in;
+    struct sockaddr_un saddr_un;
     int fd, connected, ret;
 
     switch (addr->type) {
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
             }
         }
         break;
+    case SOCKET_ADDRESS_TYPE_UNIX:
+        saddr_un.sun_family = PF_UNIX;
+        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
+                       addr->u.q_unix.path);
+        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
+            error_setg(errp, "UNIX socket path '%s' is too long",
+                       addr->u.q_unix.path);
+            error_append_hint(errp, "Path must be less than %zu bytes\n",
+                              sizeof(saddr_un.sun_path));
+            return -1;
+        }
+
+        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
+        if (fd < 0) {
+            error_setg_errno(errp, errno, "can't create stream socket");
+            return -1;
+        }
+        qemu_socket_set_nonblock(fd);
+
+        connected = 0;
+        for (;;) {
+            ret = connect(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
+            if (ret < 0) {
+                if (errno == EINTR || errno == EWOULDBLOCK) {
+                    /* continue */
+                } else if (errno == EAGAIN ||
+                           errno == EALREADY) {
+                    break;
+                } else {
+                    error_setg_errno(errp, errno, "can't connect socket");
+                    closesocket(fd);
+                    return -1;
+                }
+            } else {
+                connected = 1;
+                break;
+            }
+        }
+        break;
     case SOCKET_ADDRESS_TYPE_FD:
         fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
         if (fd == -1) {
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
         connected = 1;
         break;
     default:
-        error_setg(errp, "only support inet or fd type");
+        error_setg(errp, "only support inet, unix or fd type");
         return -1;
     }
 
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
                           inet_ntoa(saddr_in.sin_addr),
                           ntohs(saddr_in.sin_port));
         break;
+    case SOCKET_ADDRESS_TYPE_UNIX:
+        qemu_set_info_str(&s->nc, " connect to %s", saddr_un.sun_path);
+        break;
     case SOCKET_ADDRESS_TYPE_FD:
         qemu_set_info_str(&s->nc, "connect to fd %d", fd);
         break;
     default:
         g_assert_not_reached();
     }
-
     return 0;
 }
 
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 #        or connect to (server=false)
 # @server: create server socket (default: false)
 #
-# Only SocketAddress types 'inet' and 'fd' are supported.
+# Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
 #
 # Since: 7.2
 ##
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "                configure a network backend to connect to another network\n"
     "                using an UDP tunnel\n"
     "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path\n"
     "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
     "                configure a network backend to connect to another network\n"
     "                using a socket connection in stream mode.\n"
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

dgram_dst is a sockaddr_in structure. To be able to use it with
unix socket, use a pointer to a generic sockaddr structure.

Rename it dest_addr, and store socket length in dest_len.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/dgram.c | 82 +++++++++++++++++++++++++++++++++++++++----------------------
 1 file changed, 53 insertions(+), 29 deletions(-)

diff --git a/net/dgram.c b/net/dgram.c
index XXXXXXX..XXXXXXX 100644
--- a/net/dgram.c
+++ b/net/dgram.c
@@ -XXX,XX +XXX,XX @@ typedef struct NetDgramState {
     NetClientState nc;
     int fd;
     SocketReadState rs;
-    struct sockaddr_in dgram_dst; /* contains destination iff connectionless */
     bool read_poll;               /* waiting to receive data? */
     bool write_poll;              /* waiting to transmit data? */
+    /* contains destination iff connectionless */
+    struct sockaddr *dest_addr;
+    socklen_t dest_len;
 } NetDgramState;
 
 static void net_dgram_send(void *opaque);
@@ -XXX,XX +XXX,XX @@ static ssize_t net_dgram_receive(NetClientState *nc,
     ssize_t ret;
 
     do {
-        if (s->dgram_dst.sin_family != AF_UNIX) {
-            ret = sendto(s->fd, buf, size, 0,
-                         (struct sockaddr *)&s->dgram_dst,
-                         sizeof(s->dgram_dst));
+        if (s->dest_addr) {
+            ret = sendto(s->fd, buf, size, 0, s->dest_addr, s->dest_len);
         } else {
             ret = send(s->fd, buf, size, 0);
         }
@@ -XXX,XX +XXX,XX @@ static void net_dgram_cleanup(NetClientState *nc)
         close(s->fd);
         s->fd = -1;
     }
+    g_free(s->dest_addr);
+    s->dest_addr = NULL;
+    s->dest_len = 0;
 }
 
 static NetClientInfo net_dgram_socket_info = {
@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
                                         SocketAddress *mcast,
                                         Error **errp)
 {
-    struct sockaddr_in saddr;
+    struct sockaddr_in *saddr = NULL;
     int newfd;
     NetClientState *nc;
     NetDgramState *s;
@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
     qapi_free_SocketAddress(sa);
 
     /*
-     * fd passed: multicast: "learn" dgram_dst address from bound address and
+     * fd passed: multicast: "learn" dest_addr address from bound address and
      * save it. Because this may be "shared" socket from a "master" process,
      * datagrams would be recv() by ONLY ONE process: we must "clone" this
      * dgram socket --jjo
      */
 
     if (is_fd && mcast != NULL) {
-            if (convert_host_port(&saddr, mcast->u.inet.host,
-                                  mcast->u.inet.port, errp) < 0) {
+            saddr = g_new(struct sockaddr_in, 1);
+
+            if (convert_host_port(saddr, mcast->u.inet.host, mcast->u.inet.port,
+                                  errp) < 0) {
                 goto err;
             }
             /* must be bound */
-            if (saddr.sin_addr.s_addr == 0) {
+            if (saddr->sin_addr.s_addr == 0) {
                 error_setg(errp, "can't setup multicast destination address");
                 goto err;
             }
             /* clone dgram socket */
-            newfd = net_dgram_mcast_create(&saddr, NULL, errp);
+            newfd = net_dgram_mcast_create(saddr, NULL, errp);
             if (newfd < 0) {
                 goto err;
             }
             /* clone newfd to fd, close newfd */
             dup2(newfd, fd);
             close(newfd);
-
     }
 
     nc = qemu_new_net_client(&net_dgram_socket_info, peer, model, name);
@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
     net_dgram_read_poll(s, true);
 
     /* mcast: save bound address as dst */
-    if (is_fd && mcast != NULL) {
-        s->dgram_dst = saddr;
+    if (saddr) {
+        g_assert(s->dest_addr == NULL);
+        s->dest_addr = (struct sockaddr *)saddr;
+        s->dest_len = sizeof(*saddr);
         qemu_set_info_str(nc, "fd=%d (cloned mcast=%s:%d)", fd,
-                          inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
+                          inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
     } else {
-        if (sa_type == SOCKET_ADDRESS_TYPE_UNIX) {
-            s->dgram_dst.sin_family = AF_UNIX;
-        }
-
         qemu_set_info_str(nc, "fd=%d %s", fd, SocketAddressType_str(sa_type));
     }
 
     return s;
 
 err:
+    g_free(saddr);
     closesocket(fd);
     return NULL;
 }
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
 {
     NetDgramState *s;
     int fd, ret;
-    struct sockaddr_in saddr;
+    struct sockaddr_in *saddr;
 
     if (remote->type != SOCKET_ADDRESS_TYPE_INET) {
         error_setg(errp, "multicast only support inet type");
         return -1;
     }
 
-    if (convert_host_port(&saddr, remote->u.inet.host, remote->u.inet.port,
+    saddr = g_new(struct sockaddr_in, 1);
+    if (convert_host_port(saddr, remote->u.inet.host, remote->u.inet.port,
                           errp) < 0) {
+        g_free(saddr);
         return -1;
     }
 
     if (!local) {
-        fd = net_dgram_mcast_create(&saddr, NULL, errp);
+        fd = net_dgram_mcast_create(saddr, NULL, errp);
         if (fd < 0) {
+            g_free(saddr);
             return -1;
         }
     } else {
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
             struct in_addr localaddr;
 
             if (inet_aton(local->u.inet.host, &localaddr) == 0) {
+                g_free(saddr);
                 error_setg(errp, "localaddr '%s' is not a valid IPv4 address",
                            local->u.inet.host);
                 return -1;
             }
 
-            fd = net_dgram_mcast_create(&saddr, &localaddr, errp);
+            fd = net_dgram_mcast_create(saddr, &localaddr, errp);
             if (fd < 0) {
+                g_free(saddr);
                 return -1;
             }
             break;
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
         case SOCKET_ADDRESS_TYPE_FD:
             fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
             if (fd == -1) {
+                g_free(saddr);
                 return -1;
             }
             ret = qemu_socket_try_set_nonblock(fd);
             if (ret < 0) {
+                g_free(saddr);
                 error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
                                  name, fd);
                 return -1;
             }
             break;
         default:
+            g_free(saddr);
             error_setg(errp, "only support inet or fd type for local");
             return -1;
         }
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
                           local->type == SOCKET_ADDRESS_TYPE_FD,
                           remote, errp);
     if (!s) {
+        g_free(saddr);
         return -1;
     }
 
-    s->dgram_dst = saddr;
+    g_assert(s->dest_addr == NULL);
+    s->dest_addr = (struct sockaddr *)saddr;
+    s->dest_len = sizeof(*saddr);
+
+    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr->sin_addr),
+                      ntohs(saddr->sin_port));
 
-    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr.sin_addr),
-                      ntohs(saddr.sin_port));
     return 0;
 
 }
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
 {
     NetDgramState *s;
     int fd, ret;
-    struct sockaddr_in raddr_in;
-    struct sockaddr_in laddr_in;
     SocketAddress *remote, *local;
+    struct sockaddr *dest_addr;
+    struct sockaddr_in laddr_in, raddr_in;
+    socklen_t dest_len;
 
     assert(netdev->type == NET_CLIENT_DRIVER_DGRAM);
 
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
             return -1;
         }
         qemu_socket_set_nonblock(fd);
+
+        dest_len = sizeof(raddr_in);
+        dest_addr = g_malloc(dest_len);
+        memcpy(dest_addr, &raddr_in, dest_len);
         break;
     case SOCKET_ADDRESS_TYPE_FD:
         fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
                              name, fd);
             return -1;
         }
+        dest_addr = NULL;
+        dest_len = 0;
         break;
     default:
         error_setg(errp, "only support inet or fd type for local");
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
     }
 
     if (remote) {
-        s->dgram_dst = raddr_in;
+        g_assert(s->dest_addr == NULL);
+        s->dest_addr = dest_addr;
+        s->dest_len = dest_len;
     }
 
     switch (local->type) {
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

It is less complex to manage special cases directly in
net_dgram_mcast_init() and net_dgram_udp_init().

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/dgram.c | 143 ++++++++++++++++++++++++++++++++----------------------------
 1 file changed, 76 insertions(+), 67 deletions(-)

diff --git a/net/dgram.c b/net/dgram.c
index XXXXXXX..XXXXXXX 100644
--- a/net/dgram.c
+++ b/net/dgram.c
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_dgram_socket_info = {
 static NetDgramState *net_dgram_fd_init(NetClientState *peer,
                                         const char *model,
                                         const char *name,
-                                        int fd, int is_fd,
-                                        SocketAddress *mcast,
+                                        int fd,
                                         Error **errp)
 {
-    struct sockaddr_in *saddr = NULL;
-    int newfd;
     NetClientState *nc;
     NetDgramState *s;
-    SocketAddress *sa;
-    SocketAddressType sa_type;
-
-    sa = socket_local_address(fd, errp);
-    if (!sa) {
-        return NULL;
-    }
-    sa_type = sa->type;
-    qapi_free_SocketAddress(sa);
-
-    /*
-     * fd passed: multicast: "learn" dest_addr address from bound address and
-     * save it. Because this may be "shared" socket from a "master" process,
-     * datagrams would be recv() by ONLY ONE process: we must "clone" this
-     * dgram socket --jjo
-     */
-
-    if (is_fd && mcast != NULL) {
-            saddr = g_new(struct sockaddr_in, 1);
-
-            if (convert_host_port(saddr, mcast->u.inet.host, mcast->u.inet.port,
-                                  errp) < 0) {
-                goto err;
-            }
-            /* must be bound */
-            if (saddr->sin_addr.s_addr == 0) {
-                error_setg(errp, "can't setup multicast destination address");
-                goto err;
-            }
-            /* clone dgram socket */
-            newfd = net_dgram_mcast_create(saddr, NULL, errp);
-            if (newfd < 0) {
-                goto err;
-            }
-            /* clone newfd to fd, close newfd */
-            dup2(newfd, fd);
-            close(newfd);
-    }
 
     nc = qemu_new_net_client(&net_dgram_socket_info, peer, model, name);
 
@@ -XXX,XX +XXX,XX @@ static NetDgramState *net_dgram_fd_init(NetClientState *peer,
     net_socket_rs_init(&s->rs, net_dgram_rs_finalize, false);
     net_dgram_read_poll(s, true);
 
-    /* mcast: save bound address as dst */
-    if (saddr) {
-        g_assert(s->dest_addr == NULL);
-        s->dest_addr = (struct sockaddr *)saddr;
-        s->dest_len = sizeof(*saddr);
-        qemu_set_info_str(nc, "fd=%d (cloned mcast=%s:%d)", fd,
-                          inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
-    } else {
-        qemu_set_info_str(nc, "fd=%d %s", fd, SocketAddressType_str(sa_type));
-    }
-
     return s;
-
-err:
-    g_free(saddr);
-    closesocket(fd);
-    return NULL;
 }
 
 static int net_dgram_mcast_init(NetClientState *peer,
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
             }
             break;
         }
-        case SOCKET_ADDRESS_TYPE_FD:
+        case SOCKET_ADDRESS_TYPE_FD: {
+            int newfd;
+
             fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
             if (fd == -1) {
                 g_free(saddr);
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
                                  name, fd);
                 return -1;
             }
+
+            /*
+             * fd passed: multicast: "learn" dest_addr address from bound
+             * address and save it. Because this may be "shared" socket from a
+             * "master" process, datagrams would be recv() by ONLY ONE process:
+             * we must "clone" this dgram socket --jjo
+             */
+
+            saddr = g_new(struct sockaddr_in, 1);
+
+            if (convert_host_port(saddr, local->u.inet.host, local->u.inet.port,
+                                  errp) < 0) {
+                g_free(saddr);
+                closesocket(fd);
+                return -1;
+            }
+
+            /* must be bound */
+            if (saddr->sin_addr.s_addr == 0) {
+                error_setg(errp, "can't setup multicast destination address");
+                g_free(saddr);
+                closesocket(fd);
+                return -1;
+            }
+            /* clone dgram socket */
+            newfd = net_dgram_mcast_create(saddr, NULL, errp);
+            if (newfd < 0) {
+                g_free(saddr);
+                closesocket(fd);
+                return -1;
+            }
+            /* clone newfd to fd, close newfd */
+            dup2(newfd, fd);
+            close(newfd);
             break;
+        }
         default:
             g_free(saddr);
             error_setg(errp, "only support inet or fd type for local");
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
         }
     }
 
-    s = net_dgram_fd_init(peer, model, name, fd,
-                          local->type == SOCKET_ADDRESS_TYPE_FD,
-                          remote, errp);
+    s = net_dgram_fd_init(peer, model, name, fd, errp);
     if (!s) {
         g_free(saddr);
         return -1;
@@ -XXX,XX +XXX,XX @@ static int net_dgram_mcast_init(NetClientState *peer,
     s->dest_addr = (struct sockaddr *)saddr;
     s->dest_len = sizeof(*saddr);
 
-    qemu_set_info_str(&s->nc, "mcast=%s:%d", inet_ntoa(saddr->sin_addr),
-                      ntohs(saddr->sin_port));
+    if (!local) {
+        qemu_set_info_str(&s->nc, "mcast=%s:%d",
+                          inet_ntoa(saddr->sin_addr),
+                          ntohs(saddr->sin_port));
+    } else {
+        switch (local->type) {
+        case SOCKET_ADDRESS_TYPE_INET:
+            qemu_set_info_str(&s->nc, "mcast=%s:%d",
+                              inet_ntoa(saddr->sin_addr),
+                              ntohs(saddr->sin_port));
+            break;
+        case SOCKET_ADDRESS_TYPE_FD:
+            qemu_set_info_str(&s->nc, "fd=%d (cloned mcast=%s:%d)",
+                              fd, inet_ntoa(saddr->sin_addr),
+                              ntohs(saddr->sin_port));
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    }
 
     return 0;
 
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
         return -1;
     }
 
-    s = net_dgram_fd_init(peer, "dgram", name, fd, 0, NULL, errp);
+    s = net_dgram_fd_init(peer, "dgram", name, fd, errp);
     if (!s) {
         return -1;
     }
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
                           inet_ntoa(raddr_in.sin_addr),
                           ntohs(raddr_in.sin_port));
         break;
-    case SOCKET_ADDRESS_TYPE_FD:
-        qemu_set_info_str(&s->nc, "fd=%d", fd);
+    case SOCKET_ADDRESS_TYPE_FD: {
+        SocketAddress *sa;
+        SocketAddressType sa_type;
+
+        sa = socket_local_address(fd, errp);
+        if (sa) {
+            sa_type = sa->type;
+            qapi_free_SocketAddress(sa);
+
+            qemu_set_info_str(&s->nc, "fd=%d %s", fd,
+                              SocketAddressType_str(sa_type));
+        } else {
+            qemu_set_info_str(&s->nc, "fd=%d", fd);
+        }
         break;
+    }
     default:
         g_assert_not_reached();
     }
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com> (QAPI schema)
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/dgram.c     | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 qapi/net.json   |  2 +-
 qemu-options.hx |  1 +
 3 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/net/dgram.c b/net/dgram.c
index XXXXXXX..XXXXXXX 100644
--- a/net/dgram.c
+++ b/net/dgram.c
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
     SocketAddress *remote, *local;
     struct sockaddr *dest_addr;
     struct sockaddr_in laddr_in, raddr_in;
+    struct sockaddr_un laddr_un, raddr_un;
     socklen_t dest_len;
 
     assert(netdev->type == NET_CLIENT_DRIVER_DGRAM);
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
         }
     } else {
         if (local->type != SOCKET_ADDRESS_TYPE_FD) {
-            error_setg(errp, "type=inet requires remote parameter");
+            error_setg(errp,
+                       "type=inet or type=unix requires remote parameter");
             return -1;
         }
     }
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
         dest_addr = g_malloc(dest_len);
         memcpy(dest_addr, &raddr_in, dest_len);
         break;
+    case SOCKET_ADDRESS_TYPE_UNIX:
+        ret = unlink(local->u.q_unix.path);
+        if (ret < 0 && errno != ENOENT) {
+            error_setg_errno(errp, errno, "failed to unlink socket %s",
+                             local->u.q_unix.path);
+            return -1;
+        }
+
+        laddr_un.sun_family = PF_UNIX;
+        ret = snprintf(laddr_un.sun_path, sizeof(laddr_un.sun_path), "%s",
+                       local->u.q_unix.path);
+        if (ret < 0 || ret >= sizeof(laddr_un.sun_path)) {
+            error_setg(errp, "UNIX socket path '%s' is too long",
+                       local->u.q_unix.path);
+            error_append_hint(errp, "Path must be less than %zu bytes\n",
+                              sizeof(laddr_un.sun_path));
+        }
+
+        raddr_un.sun_family = PF_UNIX;
+        ret = snprintf(raddr_un.sun_path, sizeof(raddr_un.sun_path), "%s",
+                       remote->u.q_unix.path);
+        if (ret < 0 || ret >= sizeof(raddr_un.sun_path)) {
+            error_setg(errp, "UNIX socket path '%s' is too long",
+                       remote->u.q_unix.path);
+            error_append_hint(errp, "Path must be less than %zu bytes\n",
+                              sizeof(raddr_un.sun_path));
+        }
+
+        fd = qemu_socket(PF_UNIX, SOCK_DGRAM, 0);
+        if (fd < 0) {
+            error_setg_errno(errp, errno, "can't create datagram socket");
+            return -1;
+        }
+
+        ret = bind(fd, (struct sockaddr *)&laddr_un, sizeof(laddr_un));
+        if (ret < 0) {
+            error_setg_errno(errp, errno, "can't bind unix=%s to socket",
+                             laddr_un.sun_path);
+            closesocket(fd);
+            return -1;
+        }
+        qemu_socket_set_nonblock(fd);
+
+        dest_len = sizeof(raddr_un);
+        dest_addr = g_malloc(dest_len);
+        memcpy(dest_addr, &raddr_un, dest_len);
+        break;
     case SOCKET_ADDRESS_TYPE_FD:
         fd = monitor_fd_param(monitor_cur(), local->u.fd.str, errp);
         if (fd == -1) {
@@ -XXX,XX +XXX,XX @@ int net_init_dgram(const Netdev *netdev, const char *name,
                           inet_ntoa(raddr_in.sin_addr),
                           ntohs(raddr_in.sin_port));
         break;
+    case SOCKET_ADDRESS_TYPE_UNIX:
+        qemu_set_info_str(&s->nc, "udp=%s:%s",
+                          laddr_un.sun_path, raddr_un.sun_path);
+        break;
     case SOCKET_ADDRESS_TYPE_FD: {
         SocketAddress *sa;
         SocketAddressType sa_type;
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 # @remote: remote address
 # @local: local address
 #
-# Only SocketAddress types 'inet' and 'fd' are supported.
+# Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
 #
 # If remote address is present and it's a multicast address, local address
 # is optional. Otherwise local address is required and remote address is
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "                configure a network backend to connect to a multicast maddr and port\n"
     "                use ``local.host=addr`` to specify the host address to send packets from\n"
     "-netdev dgram,id=str,local.type=inet,local.host=addr,local.port=port[,remote.type=inet,remote.host=addr,remote.port=port]\n"
+    "-netdev dgram,id=str,local.type=unix,local.path=path[,remote.type=unix,remote.path=path]\n"
     "-netdev dgram,id=str,local.type=fd,local.str=file-descriptor\n"
     "                configure a network backend to connect to another network\n"
     "                using an UDP tunnel\n"
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

Rename SocketAddress_to_str() to socket_uri() and move it to
util/qemu-sockets.c close to socket_parse().

socket_uri() generates a string from a SocketAddress while
socket_parse() generates a SocketAddress from a string.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/qemu/sockets.h |  2 +-
 monitor/hmp-cmds.c     | 23 +----------------------
 util/qemu-sockets.c    | 20 ++++++++++++++++++++
 3 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -XXX,XX +XXX,XX @@ NetworkAddressFamily inet_netfamily(int family);
 int unix_listen(const char *path, Error **errp);
 int unix_connect(const char *path, Error **errp);
 
+char *socket_uri(SocketAddress *addr);
 SocketAddress *socket_parse(const char *str, Error **errp);
 int socket_connect(SocketAddress *addr, Error **errp);
 int socket_listen(SocketAddress *addr, int num, Error **errp);
@@ -XXX,XX +XXX,XX @@ SocketAddress *socket_address_flatten(SocketAddressLegacy *addr);
  * Return 0 on success.
  */
 int socket_address_parse_named_fd(SocketAddress *addr, Error **errp);
-
 #endif /* QEMU_SOCKETS_H */
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -XXX,XX +XXX,XX @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
     qapi_free_MouseInfoList(mice_list);
 }
 
-static char *SocketAddress_to_str(SocketAddress *addr)
-{
-    switch (addr->type) {
-    case SOCKET_ADDRESS_TYPE_INET:
-        return g_strdup_printf("tcp:%s:%s",
-                               addr->u.inet.host,
-                               addr->u.inet.port);
-    case SOCKET_ADDRESS_TYPE_UNIX:
-        return g_strdup_printf("unix:%s",
-                               addr->u.q_unix.path);
-    case SOCKET_ADDRESS_TYPE_FD:
-        return g_strdup_printf("fd:%s", addr->u.fd.str);
-    case SOCKET_ADDRESS_TYPE_VSOCK:
-        return g_strdup_printf("tcp:%s:%s",
-                               addr->u.vsock.cid,
-                               addr->u.vsock.port);
-    default:
-        return g_strdup("unknown address type");
-    }
-}
-
 void hmp_info_migrate(Monitor *mon, const QDict *qdict)
 {
     MigrationInfo *info;
@@ -XXX,XX +XXX,XX @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "socket address: [\n");
 
         for (addr = info->socket_address; addr; addr = addr->next) {
-            char *s = SocketAddress_to_str(addr->value);
+            char *s = socket_uri(addr->value);
             monitor_printf(mon, "\t%s\n", s);
             g_free(s);
         }
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -XXX,XX +XXX,XX @@ int unix_connect(const char *path, Error **errp)
     return sock;
 }
 
+char *socket_uri(SocketAddress *addr)
+{
+    switch (addr->type) {
+    case SOCKET_ADDRESS_TYPE_INET:
+        return g_strdup_printf("tcp:%s:%s",
+                               addr->u.inet.host,
+                               addr->u.inet.port);
+    case SOCKET_ADDRESS_TYPE_UNIX:
+        return g_strdup_printf("unix:%s",
+                               addr->u.q_unix.path);
+    case SOCKET_ADDRESS_TYPE_FD:
+        return g_strdup_printf("fd:%s", addr->u.fd.str);
+    case SOCKET_ADDRESS_TYPE_VSOCK:
+        return g_strdup_printf("tcp:%s:%s",
+                               addr->u.vsock.cid,
+                               addr->u.vsock.port);
+    default:
+        return g_strdup("unknown address type");
+    }
+}
 
 SocketAddress *socket_parse(const char *str, Error **errp)
 {
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

To be consistent with socket_uri(), add 'tcp:' prefix for inet type in
socket_parse(), by default socket_parse() use tcp when no prefix is
provided (format is host:port).

In socket_uri(), use 'vsock:' prefix for vsock type rather than 'tcp:'
because it makes a vsock address look like an inet address with CID
misinterpreted as host.
Goes back to commit 9aca82ba31 "migration: Create socket-address parameter"

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 util/qemu-sockets.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -XXX,XX +XXX,XX @@ char *socket_uri(SocketAddress *addr)
     case SOCKET_ADDRESS_TYPE_FD:
         return g_strdup_printf("fd:%s", addr->u.fd.str);
     case SOCKET_ADDRESS_TYPE_VSOCK:
-        return g_strdup_printf("tcp:%s:%s",
+        return g_strdup_printf("vsock:%s:%s",
                                addr->u.vsock.cid,
                                addr->u.vsock.port);
     default:
@@ -XXX,XX +XXX,XX @@ SocketAddress *socket_parse(const char *str, Error **errp)
         if (vsock_parse(&addr->u.vsock, str + strlen("vsock:"), errp)) {
             goto fail;
         }
+    } else if (strstart(str, "tcp:", NULL)) {
+        addr->type = SOCKET_ADDRESS_TYPE_INET;
+        if (inet_parse(&addr->u.inet, str + strlen("tcp:"), errp)) {
+            goto fail;
+        }
     } else {
         addr->type = SOCKET_ADDRESS_TYPE_INET;
         if (inet_parse(&addr->u.inet, str, errp)) {
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

Use QIOChannel, QIOChannelSocket and QIONetListener.
This allows net/stream to use all the available parameters provided by
SocketAddress.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/stream.c    | 492 ++++++++++++++++++++------------------------------------
 qemu-options.hx |   4 +-
 2 files changed, 178 insertions(+), 318 deletions(-)

diff --git a/net/stream.c b/net/stream.c
index XXXXXXX..XXXXXXX 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/iov.h"
 #include "qemu/main-loop.h"
 #include "qemu/cutils.h"
+#include "io/channel.h"
+#include "io/channel-socket.h"
+#include "io/net-listener.h"
 
 typedef struct NetStreamState {
     NetClientState nc;
-    int listen_fd;
-    int fd;
+    QIOChannel *listen_ioc;
+    QIONetListener *listener;
+    QIOChannel *ioc;
+    guint ioc_read_tag;
+    guint ioc_write_tag;
     SocketReadState rs;
     unsigned int send_index;      /* number of bytes sent*/
-    bool read_poll;               /* waiting to receive data? */
-    bool write_poll;              /* waiting to transmit data? */
 } NetStreamState;
 
-static void net_stream_send(void *opaque);
-static void net_stream_accept(void *opaque);
-static void net_stream_writable(void *opaque);
+static void net_stream_listen(QIONetListener *listener,
+                              QIOChannelSocket *cioc,
+                              void *opaque);
 
-static void net_stream_update_fd_handler(NetStreamState *s)
+static gboolean net_stream_writable(QIOChannel *ioc,
+                                    GIOCondition condition,
+                                    gpointer data)
 {
-    qemu_set_fd_handler(s->fd,
-                        s->read_poll ? net_stream_send : NULL,
-                        s->write_poll ? net_stream_writable : NULL,
-                        s);
-}
-
-static void net_stream_read_poll(NetStreamState *s, bool enable)
-{
-    s->read_poll = enable;
-    net_stream_update_fd_handler(s);
-}
-
-static void net_stream_write_poll(NetStreamState *s, bool enable)
-{
-    s->write_poll = enable;
-    net_stream_update_fd_handler(s);
-}
-
-static void net_stream_writable(void *opaque)
-{
-    NetStreamState *s = opaque;
+    NetStreamState *s = data;
 
-    net_stream_write_poll(s, false);
+    s->ioc_write_tag = 0;
 
     qemu_flush_queued_packets(&s->nc);
+
+    return G_SOURCE_REMOVE;
 }
 
 static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
             .iov_len  = size,
         },
     };
+    struct iovec local_iov[2];
+    unsigned int nlocal_iov;
     size_t remaining;
     ssize_t ret;
 
     remaining = iov_size(iov, 2) - s->send_index;
-    ret = iov_send(s->fd, iov, 2, s->send_index, remaining);
-
-    if (ret == -1 && errno == EAGAIN) {
+    nlocal_iov = iov_copy(local_iov, 2, iov, 2, s->send_index, remaining);
+    ret = qio_channel_writev(s->ioc, local_iov, nlocal_iov, NULL);
+    if (ret == QIO_CHANNEL_ERR_BLOCK) {
         ret = 0; /* handled further down */
     }
     if (ret == -1) {
@@ -XXX,XX +XXX,XX @@ static ssize_t net_stream_receive(NetClientState *nc, const uint8_t *buf,
     }
     if (ret < (ssize_t)remaining) {
         s->send_index += ret;
-        net_stream_write_poll(s, true);
+        s->ioc_write_tag = qio_channel_add_watch(s->ioc, G_IO_OUT,
+                                                 net_stream_writable, s, NULL);
         return 0;
     }
     s->send_index = 0;
     return size;
 }
 
+static gboolean net_stream_send(QIOChannel *ioc,
+                                GIOCondition condition,
+                                gpointer data);
+
 static void net_stream_send_completed(NetClientState *nc, ssize_t len)
 {
     NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
 
-    if (!s->read_poll) {
-        net_stream_read_poll(s, true);
+    if (!s->ioc_read_tag) {
+        s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN,
+                                                net_stream_send, s, NULL);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void net_stream_rs_finalize(SocketReadState *rs)
     if (qemu_send_packet_async(&s->nc, rs->buf,
                                rs->packet_len,
                                net_stream_send_completed) == 0) {
-        net_stream_read_poll(s, false);
+        if (s->ioc_read_tag) {
+            g_source_remove(s->ioc_read_tag);
+            s->ioc_read_tag = 0;
+        }
     }
 }
 
-static void net_stream_send(void *opaque)
+static gboolean net_stream_send(QIOChannel *ioc,
+                                GIOCondition condition,
+                                gpointer data)
 {
-    NetStreamState *s = opaque;
+    NetStreamState *s = data;
     int size;
     int ret;
-    uint8_t buf1[NET_BUFSIZE];
-    const uint8_t *buf;
+    char buf1[NET_BUFSIZE];
+    const char *buf;
 
-    size = recv(s->fd, buf1, sizeof(buf1), 0);
+    size = qio_channel_read(s->ioc, buf1, sizeof(buf1), NULL);
     if (size < 0) {
         if (errno != EWOULDBLOCK) {
             goto eoc;
@@ -XXX,XX +XXX,XX @@ static void net_stream_send(void *opaque)
     } else if (size == 0) {
         /* end of connection */
     eoc:
-        net_stream_read_poll(s, false);
-        net_stream_write_poll(s, false);
-        if (s->listen_fd != -1) {
-            qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
+        s->ioc_read_tag = 0;
+        if (s->ioc_write_tag) {
+            g_source_remove(s->ioc_write_tag);
+            s->ioc_write_tag = 0;
         }
-        closesocket(s->fd);
+        if (s->listener) {
+            qio_net_listener_set_client_func(s->listener, net_stream_listen,
+                                             s, NULL);
+        }
+        object_unref(OBJECT(s->ioc));
+        s->ioc = NULL;
 
-        s->fd = -1;
         net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
         s->nc.link_down = true;
         qemu_set_info_str(&s->nc, "");
 
-        return;
+        return G_SOURCE_REMOVE;
     }
     buf = buf1;
 
-    ret = net_fill_rstate(&s->rs, buf, size);
+    ret = net_fill_rstate(&s->rs, (const uint8_t *)buf, size);
 
     if (ret == -1) {
         goto eoc;
     }
+
+    return G_SOURCE_CONTINUE;
 }
 
 static void net_stream_cleanup(NetClientState *nc)
 {
     NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
-    if (s->fd != -1) {
-        net_stream_read_poll(s, false);
-        net_stream_write_poll(s, false);
-        close(s->fd);
-        s->fd = -1;
+    if (s->ioc) {
+        if (QIO_CHANNEL_SOCKET(s->ioc)->fd != -1) {
+            if (s->ioc_read_tag) {
+                g_source_remove(s->ioc_read_tag);
+                s->ioc_read_tag = 0;
+            }
+            if (s->ioc_write_tag) {
+                g_source_remove(s->ioc_write_tag);
+                s->ioc_write_tag = 0;
+            }
+        }
+        object_unref(OBJECT(s->ioc));
+        s->ioc = NULL;
     }
-    if (s->listen_fd != -1) {
-        qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
-        closesocket(s->listen_fd);
-        s->listen_fd = -1;
+    if (s->listen_ioc) {
+        if (s->listener) {
+            qio_net_listener_disconnect(s->listener);
+            object_unref(OBJECT(s->listener));
+            s->listener = NULL;
+        }
+        object_unref(OBJECT(s->listen_ioc));
+        s->listen_ioc = NULL;
     }
 }
 
-static void net_stream_connect(void *opaque)
-{
-    NetStreamState *s = opaque;
-    net_stream_read_poll(s, true);
-}
-
 static NetClientInfo net_stream_info = {
     .type = NET_CLIENT_DRIVER_STREAM,
     .size = sizeof(NetStreamState),
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_stream_info = {
     .cleanup = net_stream_cleanup,
 };
 
-static NetStreamState *net_stream_fd_init(NetClientState *peer,
-                                          const char *model,
-                                          const char *name,
-                                          int fd, int is_connected)
+static void net_stream_listen(QIONetListener *listener,
+                              QIOChannelSocket *cioc,
+                              void *opaque)
 {
-    NetClientState *nc;
-    NetStreamState *s;
-
-    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
+    NetStreamState *s = opaque;
+    SocketAddress *addr;
+    char *uri;
 
-    qemu_set_info_str(nc, "fd=%d", fd);
+    object_ref(OBJECT(cioc));
 
-    s = DO_UPCAST(NetStreamState, nc, nc);
+    qio_net_listener_set_client_func(s->listener, NULL, s, NULL);
 
-    s->fd = fd;
-    s->listen_fd = -1;
-    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
+    s->ioc = QIO_CHANNEL(cioc);
+    qio_channel_set_name(s->ioc, "stream-server");
+    s->nc.link_down = false;
 
-    /* Disable Nagle algorithm on TCP sockets to reduce latency */
-    socket_set_nodelay(fd);
+    s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
+                                            s, NULL);
 
-    if (is_connected) {
-        net_stream_connect(s);
+    if (cioc->localAddr.ss_family == AF_UNIX) {
+        addr = qio_channel_socket_get_local_address(cioc, NULL);
     } else {
-        qemu_set_fd_handler(s->fd, NULL, net_stream_connect, s);
+        addr = qio_channel_socket_get_remote_address(cioc, NULL);
     }
-    return s;
+    g_assert(addr != NULL);
+    uri = socket_uri(addr);
+    qemu_set_info_str(&s->nc, uri);
+    g_free(uri);
+    qapi_free_SocketAddress(addr);
 }
 
-static void net_stream_accept(void *opaque)
+static void net_stream_server_listening(QIOTask *task, gpointer opaque)
 {
     NetStreamState *s = opaque;
-    struct sockaddr_storage saddr;
-    socklen_t len;
-    int fd;
-
-    for (;;) {
-        len = sizeof(saddr);
-        fd = qemu_accept(s->listen_fd, (struct sockaddr *)&saddr, &len);
-        if (fd < 0 && errno != EINTR) {
-            return;
-        } else if (fd >= 0) {
-            qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
-            break;
-        }
-    }
+    QIOChannelSocket *listen_sioc = QIO_CHANNEL_SOCKET(s->listen_ioc);
+    SocketAddress *addr;
+    int ret;
 
-    s->fd = fd;
-    s->nc.link_down = false;
-    net_stream_connect(s);
-    switch (saddr.ss_family) {
-    case AF_INET: {
-        struct sockaddr_in *saddr_in = (struct sockaddr_in *)&saddr;
-
-        qemu_set_info_str(&s->nc, "connection from %s:%d",
-                          inet_ntoa(saddr_in->sin_addr),
-                          ntohs(saddr_in->sin_port));
-        break;
+    if (listen_sioc->fd < 0) {
+        qemu_set_info_str(&s->nc, "connection error");
+        return;
     }
-    case AF_UNIX: {
-        struct sockaddr_un saddr_un;
 
-        len = sizeof(saddr_un);
-        getsockname(s->listen_fd, (struct sockaddr *)&saddr_un, &len);
-        qemu_set_info_str(&s->nc, "connect from %s", saddr_un.sun_path);
-        break;
-    }
-    default:
-        g_assert_not_reached();
+    addr = qio_channel_socket_get_local_address(listen_sioc, NULL);
+    g_assert(addr != NULL);
+    ret = qemu_socket_try_set_nonblock(listen_sioc->fd);
+    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
+        qemu_set_info_str(&s->nc, "can't use file descriptor %s (errno %d)",
+                          addr->u.fd.str, -ret);
+        return;
     }
+    g_assert(ret == 0);
+    qapi_free_SocketAddress(addr);
+
+    s->nc.link_down = true;
+    s->listener = qio_net_listener_new();
+
+    net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
+    qio_net_listener_set_client_func(s->listener, net_stream_listen, s, NULL);
+    qio_net_listener_add(s->listener, listen_sioc);
 }
 
 static int net_stream_server_init(NetClientState *peer,
@@ -XXX,XX +XXX,XX @@ static int net_stream_server_init(NetClientState *peer,
 {
     NetClientState *nc;
     NetStreamState *s;
-    int fd, ret;
+    QIOChannelSocket *listen_sioc = qio_channel_socket_new();
 
-    switch (addr->type) {
-    case SOCKET_ADDRESS_TYPE_INET: {
-        struct sockaddr_in saddr_in;
-
-        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
-                              errp) < 0) {
-            return -1;
-        }
-
-        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
-        if (fd < 0) {
-            error_setg_errno(errp, errno, "can't create stream socket");
-            return -1;
-        }
-        qemu_socket_set_nonblock(fd);
+    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
+    s = DO_UPCAST(NetStreamState, nc, nc);
 
-        socket_set_fast_reuse(fd);
+    s->listen_ioc = QIO_CHANNEL(listen_sioc);
+    qio_channel_socket_listen_async(listen_sioc, addr, 0,
+                                    net_stream_server_listening, s,
+                                    NULL, NULL);
 
-        ret = bind(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
-        if (ret < 0) {
-            error_setg_errno(errp, errno, "can't bind ip=%s to socket",
-                             inet_ntoa(saddr_in.sin_addr));
-            closesocket(fd);
-            return -1;
-        }
-        break;
-    }
-    case SOCKET_ADDRESS_TYPE_UNIX: {
-        struct sockaddr_un saddr_un;
-
-        ret = unlink(addr->u.q_unix.path);
-        if (ret < 0 && errno != ENOENT) {
-            error_setg_errno(errp, errno, "failed to unlink socket %s",
-                             addr->u.q_unix.path);
-            return -1;
-        }
+    return 0;
+}
 
-        saddr_un.sun_family = PF_UNIX;
-        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
-                       addr->u.q_unix.path);
-        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
-            error_setg(errp, "UNIX socket path '%s' is too long",
-                       addr->u.q_unix.path);
-            error_append_hint(errp, "Path must be less than %zu bytes\n",
-                              sizeof(saddr_un.sun_path));
-            return -1;
-        }
+static void net_stream_client_connected(QIOTask *task, gpointer opaque)
+{
+    NetStreamState *s = opaque;
+    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(s->ioc);
+    SocketAddress *addr;
+    gchar *uri;
+    int ret;
 
-        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
-        if (fd < 0) {
-            error_setg_errno(errp, errno, "can't create stream socket");
-            return -1;
-        }
-        qemu_socket_set_nonblock(fd);
-
-        ret = bind(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
-        if (ret < 0) {
-            error_setg_errno(errp, errno, "can't create socket with path: %s",
-                             saddr_un.sun_path);
-            closesocket(fd);
-            return -1;
-        }
-        break;
-    }
-    case SOCKET_ADDRESS_TYPE_FD:
-        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
-        if (fd == -1) {
-            return -1;
-        }
-        ret = qemu_socket_try_set_nonblock(fd);
-        if (ret < 0) {
-            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
-                             name, fd);
-            return -1;
-        }
-        break;
-    default:
-        error_setg(errp, "only support inet or fd type");
-        return -1;
+    if (sioc->fd < 0) {
+        qemu_set_info_str(&s->nc, "connection error");
+        goto error;
     }
 
-    ret = listen(fd, 0);
-    if (ret < 0) {
-        error_setg_errno(errp, errno, "can't listen on socket");
-        closesocket(fd);
-        return -1;
+    addr = qio_channel_socket_get_remote_address(sioc, NULL);
+    g_assert(addr != NULL);
+    uri = socket_uri(addr);
+    qemu_set_info_str(&s->nc, uri);
+    g_free(uri);
+
+    ret = qemu_socket_try_set_nonblock(sioc->fd);
+    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
+        qemu_set_info_str(&s->nc, "can't use file descriptor %s (errno %d)",
+                          addr->u.fd.str, -ret);
+        qapi_free_SocketAddress(addr);
+        goto error;
     }
+    g_assert(ret == 0);
 
-    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
-    s = DO_UPCAST(NetStreamState, nc, nc);
-    s->fd = -1;
-    s->listen_fd = fd;
-    s->nc.link_down = true;
     net_socket_rs_init(&s->rs, net_stream_rs_finalize, false);
 
-    qemu_set_fd_handler(s->listen_fd, net_stream_accept, NULL, s);
-    return 0;
+    /* Disable Nagle algorithm on TCP sockets to reduce latency */
+    qio_channel_set_delay(s->ioc, false);
+
+    s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
+                                            s, NULL);
+    s->nc.link_down = false;
+    qapi_free_SocketAddress(addr);
+
+    return;
+error:
+    object_unref(OBJECT(s->ioc));
+    s->ioc = NULL;
 }
 
 static int net_stream_client_init(NetClientState *peer,
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
                                   Error **errp)
 {
     NetStreamState *s;
-    struct sockaddr_in saddr_in;
-    struct sockaddr_un saddr_un;
-    int fd, connected, ret;
-
-    switch (addr->type) {
-    case SOCKET_ADDRESS_TYPE_INET:
-        if (convert_host_port(&saddr_in, addr->u.inet.host, addr->u.inet.port,
-                              errp) < 0) {
-            return -1;
-        }
+    NetClientState *nc;
+    QIOChannelSocket *sioc = qio_channel_socket_new();
 
-        fd = qemu_socket(PF_INET, SOCK_STREAM, 0);
-        if (fd < 0) {
-            error_setg_errno(errp, errno, "can't create stream socket");
-            return -1;
-        }
-        qemu_socket_set_nonblock(fd);
-
-        connected = 0;
-        for (;;) {
-            ret = connect(fd, (struct sockaddr *)&saddr_in, sizeof(saddr_in));
-            if (ret < 0) {
-                if (errno == EINTR || errno == EWOULDBLOCK) {
-                    /* continue */
-                } else if (errno == EINPROGRESS ||
-                           errno == EALREADY) {
-                    break;
-                } else {
-                    error_setg_errno(errp, errno, "can't connect socket");
-                    closesocket(fd);
-                    return -1;
-                }
-            } else {
-                connected = 1;
-                break;
-            }
-        }
-        break;
-    case SOCKET_ADDRESS_TYPE_UNIX:
-        saddr_un.sun_family = PF_UNIX;
-        ret = snprintf(saddr_un.sun_path, sizeof(saddr_un.sun_path), "%s",
-                       addr->u.q_unix.path);
-        if (ret < 0 || ret >= sizeof(saddr_un.sun_path)) {
-            error_setg(errp, "UNIX socket path '%s' is too long",
-                       addr->u.q_unix.path);
-            error_append_hint(errp, "Path must be less than %zu bytes\n",
-                              sizeof(saddr_un.sun_path));
-            return -1;
-        }
+    nc = qemu_new_net_client(&net_stream_info, peer, model, name);
+    s = DO_UPCAST(NetStreamState, nc, nc);
 
-        fd = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
-        if (fd < 0) {
-            error_setg_errno(errp, errno, "can't create stream socket");
-            return -1;
-        }
-        qemu_socket_set_nonblock(fd);
-
-        connected = 0;
-        for (;;) {
-            ret = connect(fd, (struct sockaddr *)&saddr_un, sizeof(saddr_un));
-            if (ret < 0) {
-                if (errno == EINTR || errno == EWOULDBLOCK) {
-                    /* continue */
-                } else if (errno == EAGAIN ||
-                           errno == EALREADY) {
-                    break;
-                } else {
-                    error_setg_errno(errp, errno, "can't connect socket");
-                    closesocket(fd);
-                    return -1;
-                }
-            } else {
-                connected = 1;
-                break;
-            }
-        }
-        break;
-    case SOCKET_ADDRESS_TYPE_FD:
-        fd = monitor_fd_param(monitor_cur(), addr->u.fd.str, errp);
-        if (fd == -1) {
-            return -1;
-        }
-        ret = qemu_socket_try_set_nonblock(fd);
-        if (ret < 0) {
-            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
-                             name, fd);
-            return -1;
-        }
-        connected = 1;
-        break;
-    default:
-        error_setg(errp, "only support inet, unix or fd type");
-        return -1;
-    }
+    s->ioc = QIO_CHANNEL(sioc);
+    s->nc.link_down = true;
+
+    qio_channel_socket_connect_async(sioc, addr,
+                                     net_stream_client_connected, s,
+                                     NULL, NULL);
 
-    s = net_stream_fd_init(peer, model, name, fd, connected);
-
-    switch (addr->type) {
-    case SOCKET_ADDRESS_TYPE_INET:
-        qemu_set_info_str(&s->nc, "connect to %s:%d",
-                          inet_ntoa(saddr_in.sin_addr),
-                          ntohs(saddr_in.sin_port));
-        break;
-    case SOCKET_ADDRESS_TYPE_UNIX:
-        qemu_set_info_str(&s->nc, " connect to %s", saddr_un.sun_path);
-        break;
-    case SOCKET_ADDRESS_TYPE_FD:
-        qemu_set_info_str(&s->nc, "connect to fd %d", fd);
-        break;
-    default:
-        g_assert_not_reached();
-    }
     return 0;
 }
 
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]\n"
     "                configure a network backend to connect to another network\n"
     "                using an UDP tunnel\n"
-    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port\n"
-    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off]\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off]\n"
     "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
     "                configure a network backend to connect to another network\n"
     "                using a socket connection in stream mode.\n"
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

The netdev reports NETDEV_STREAM_CONNECTED event when the backend
is connected, and NETDEV_STREAM_DISCONNECTED when it is disconnected.

The NETDEV_STREAM_CONNECTED event includes the destination address.

This allows a system manager like libvirt to detect when the server
fails.

For instance with passt:

{ 'execute': 'qmp_capabilities' }
{ "return": { } }
{ "timestamp": { "seconds": 1666341395, "microseconds": 505347 },
    "event": "NETDEV_STREAM_CONNECTED",
    "data": { "netdev-id": "netdev0",
        "addr": { "path": "/tmp/passt_1.socket", "type": "unix" } } }

[killing passt here]

{ "timestamp": { "seconds": 1666341430, "microseconds": 968694 },
    "event": "NETDEV_STREAM_DISCONNECTED",
    "data": { "netdev-id": "netdev0" } }

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/stream.c  |  5 +++++
 qapi/net.json | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/net/stream.c b/net/stream.c
index XXXXXXX..XXXXXXX 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -XXX,XX +XXX,XX @@
 #include "io/channel.h"
 #include "io/channel-socket.h"
 #include "io/net-listener.h"
+#include "qapi/qapi-events-net.h"
 
 typedef struct NetStreamState {
     NetClientState nc;
@@ -XXX,XX +XXX,XX @@ static gboolean net_stream_send(QIOChannel *ioc,
         s->nc.link_down = true;
         qemu_set_info_str(&s->nc, "");
 
+        qapi_event_send_netdev_stream_disconnected(s->nc.name);
+
         return G_SOURCE_REMOVE;
     }
     buf = buf1;
@@ -XXX,XX +XXX,XX @@ static void net_stream_listen(QIONetListener *listener,
     uri = socket_uri(addr);
     qemu_set_info_str(&s->nc, uri);
     g_free(uri);
+    qapi_event_send_netdev_stream_connected(s->nc.name, addr);
     qapi_free_SocketAddress(addr);
 }
 
@@ -XXX,XX +XXX,XX @@ static void net_stream_client_connected(QIOTask *task, gpointer opaque)
     s->ioc_read_tag = qio_channel_add_watch(s->ioc, G_IO_IN, net_stream_send,
                                             s, NULL);
     s->nc.link_down = false;
+    qapi_event_send_netdev_stream_connected(s->nc.name, addr);
     qapi_free_SocketAddress(addr);
 
     return;
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 ##
 { 'event': 'FAILOVER_NEGOTIATED',
   'data': {'device-id': 'str'} }
+
+##
+# @NETDEV_STREAM_CONNECTED:
+#
+# Emitted when the netdev stream backend is connected
+#
+# @netdev-id: QEMU netdev id that is connected
+# @addr: The destination address
+#
+# Since: 7.2
+#
+# Example:
+#
+# <- { "event": "NETDEV_STREAM_CONNECTED",
+#      "data": { "netdev-id": "netdev0",
+#                "addr": { "port": "47666", "ipv6": true,
+#                          "host": "::1", "type": "inet" } },
+#      "timestamp": { "seconds": 1666269863, "microseconds": 311222 } }
+#
+# or
+#
+# <- { "event": "NETDEV_STREAM_CONNECTED",
+#      "data": { "netdev-id": "netdev0",
+#                "addr": { "path": "/tmp/qemu0", "type": "unix" } },
+#      "timestamp": { "seconds": 1666269706, "microseconds": 413651 } }
+#
+##
+{ 'event': 'NETDEV_STREAM_CONNECTED',
+  'data': { 'netdev-id': 'str',
+            'addr': 'SocketAddress' } }
+
+##
+# @NETDEV_STREAM_DISCONNECTED:
+#
+# Emitted when the netdev stream backend is disconnected
+#
+# @netdev-id: QEMU netdev id that is disconnected
+#
+# Since: 7.2
+#
+# Example:
+#
+# <- { 'event': 'NETDEV_STREAM_DISCONNECTED',
+#      'data': {'netdev-id': 'netdev0'},
+#      'timestamp': {'seconds': 1663330937, 'microseconds': 526695} }
+#
+##
+{ 'event': 'NETDEV_STREAM_DISCONNECTED',
+  'data': { 'netdev-id': 'str' } }
-- 
2.7.4

The following changes since commit 352998df1c53b366413690d95b35f76d0721ebed:

Merge tag 'i2c-20220314' of https://github.com/philmd/qemu into staging (2022-03-14 14:39:33 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 12a195fa343aae2ead1301ce04727bd0ae25eb15:

vdpa: Expose VHOST_F_LOG_ALL on SVQ (2022-03-15 13:57:44 +0800)

----------------------------------------------------------------

Changes since V2:
- fix 32bit build errros

----------------------------------------------------------------
Eugenio Pérez (14):
      vhost: Add VhostShadowVirtqueue
      vhost: Add Shadow VirtQueue kick forwarding capabilities
      vhost: Add Shadow VirtQueue call forwarding capabilities
      vhost: Add vhost_svq_valid_features to shadow vq
      virtio: Add vhost_svq_get_vring_addr
      vdpa: adapt vhost_ops callbacks to svq
      vhost: Shadow virtqueue buffers forwarding
      util: Add iova_tree_alloc_map
      util: add iova_tree_find_iova
      vhost: Add VhostIOVATree
      vdpa: Add custom IOTLB translations to SVQ
      vdpa: Adapt vhost_vdpa_get_vring_base to SVQ
      vdpa: Never set log_base addr if SVQ is enabled
      vdpa: Expose VHOST_F_LOG_ALL on SVQ

Jason Wang (1):
      virtio-net: fix map leaking on error during receive

hw/net/virtio-net.c                |   1 +
 hw/virtio/meson.build              |   2 +-
 hw/virtio/vhost-iova-tree.c        | 110 +++++++
 hw/virtio/vhost-iova-tree.h        |  27 ++
 hw/virtio/vhost-shadow-virtqueue.c | 636 +++++++++++++++++++++++++++++++++++++
 hw/virtio/vhost-shadow-virtqueue.h |  87 +++++
 hw/virtio/vhost-vdpa.c             | 522 +++++++++++++++++++++++++++++-
 include/hw/virtio/vhost-vdpa.h     |   8 +
 include/qemu/iova-tree.h           |  38 ++-
 util/iova-tree.c                   | 170 ++++++++++
 10 files changed, 1584 insertions(+), 17 deletions(-)
 create mode 100644 hw/virtio/vhost-iova-tree.c
 create mode 100644 hw/virtio/vhost-iova-tree.h
 create mode 100644 hw/virtio/vhost-shadow-virtqueue.c
 create mode 100644 hw/virtio/vhost-shadow-virtqueue.h

Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
tries to fix the use after free of the sg by caching the virtqueue
elements in an array and unmap them at once after receiving the
packets, But it forgot to unmap the cached elements on error which
will lead to leaking of mapping and other unexpected results.

Fixing this by detaching the cached elements on error. This addresses
CVE-2022-26353.

Reported-by: Victor Tom <vv474172261@gmail.com>
Cc: qemu-stable@nongnu.org
Fixes: CVE-2022-26353
Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
 
 err:
     for (j = 0; j < i; j++) {
+        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
         g_free(elems[j]);
     }
 
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

Vhost shadow virtqueue (SVQ) is an intermediate jump for virtqueue
notifications and buffers, allowing qemu to track them. While qemu is
forwarding the buffers and virtqueue changes, it is able to commit the
memory it's being dirtied, the same way regular qemu's VirtIO devices
do.

This commit only exposes basic SVQ allocation and free. Next patches of
the series add functionality like notifications and buffers forwarding.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/meson.build              |  2 +-
 hw/virtio/vhost-shadow-virtqueue.c | 62 ++++++++++++++++++++++++++++++++++++++
 hw/virtio/vhost-shadow-virtqueue.h | 28 +++++++++++++++++
 3 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 hw/virtio/vhost-shadow-virtqueue.c
 create mode 100644 hw/virtio/vhost-shadow-virtqueue.h

diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ALL', if_true: files('vhost-stub.c'))
 
 virtio_ss = ss.source_set()
 virtio_ss.add(files('virtio.c'))
-virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c'))
+virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c', 'vhost-shadow-virtqueue.c'))
 virtio_ss.add(when: 'CONFIG_VHOST_USER', if_true: files('vhost-user.c'))
 virtio_ss.add(when: 'CONFIG_VHOST_VDPA', if_true: files('vhost-vdpa.c'))
 virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-balloon.c'))
diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * vhost shadow virtqueue
+ *
+ * SPDX-FileCopyrightText: Red Hat, Inc. 2021
+ * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/virtio/vhost-shadow-virtqueue.h"
+
+#include "qemu/error-report.h"
+
+/**
+ * Creates vhost shadow virtqueue, and instructs the vhost device to use the
+ * shadow methods and file descriptors.
+ *
+ * Returns the new virtqueue or NULL.
+ *
+ * In case of error, reason is reported through error_report.
+ */
+VhostShadowVirtqueue *vhost_svq_new(void)
+{
+    g_autofree VhostShadowVirtqueue *svq = g_new0(VhostShadowVirtqueue, 1);
+    int r;
+
+    r = event_notifier_init(&svq->hdev_kick, 0);
+    if (r != 0) {
+        error_report("Couldn't create kick event notifier: %s (%d)",
+                     g_strerror(errno), errno);
+        goto err_init_hdev_kick;
+    }
+
+    r = event_notifier_init(&svq->hdev_call, 0);
+    if (r != 0) {
+        error_report("Couldn't create call event notifier: %s (%d)",
+                     g_strerror(errno), errno);
+        goto err_init_hdev_call;
+    }
+
+    return g_steal_pointer(&svq);
+
+err_init_hdev_call:
+    event_notifier_cleanup(&svq->hdev_kick);
+
+err_init_hdev_kick:
+    return NULL;
+}
+
+/**
+ * Free the resources of the shadow virtqueue.
+ *
+ * @pvq: gpointer to SVQ so it can be used by autofree functions.
+ */
+void vhost_svq_free(gpointer pvq)
+{
+    VhostShadowVirtqueue *vq = pvq;
+    event_notifier_cleanup(&vq->hdev_kick);
+    event_notifier_cleanup(&vq->hdev_call);
+    g_free(vq);
+}
diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * vhost shadow virtqueue
+ *
+ * SPDX-FileCopyrightText: Red Hat, Inc. 2021
+ * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef VHOST_SHADOW_VIRTQUEUE_H
+#define VHOST_SHADOW_VIRTQUEUE_H
+
+#include "qemu/event_notifier.h"
+
+/* Shadow virtqueue to relay notifications */
+typedef struct VhostShadowVirtqueue {
+    /* Shadow kick notifier, sent to vhost */
+    EventNotifier hdev_kick;
+    /* Shadow call notifier, sent to vhost */
+    EventNotifier hdev_call;
+} VhostShadowVirtqueue;
+
+VhostShadowVirtqueue *vhost_svq_new(void);
+
+void vhost_svq_free(gpointer vq);
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(VhostShadowVirtqueue, vhost_svq_free);
+
+#endif
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

At this mode no buffer forwarding will be performed in SVQ mode: Qemu
will just forward the guest's kicks to the device.

Host memory notifiers regions are left out for simplicity, and they will
not be addressed in this series.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c |  55 ++++++++++++++
 hw/virtio/vhost-shadow-virtqueue.h |  14 ++++
 hw/virtio/vhost-vdpa.c             | 144 ++++++++++++++++++++++++++++++++++++-
 include/hw/virtio/vhost-vdpa.h     |   4 ++
 4 files changed, 215 insertions(+), 2 deletions(-)

From: Eugenio Pérez <eperezma@redhat.com>

This will make qemu aware of the device used buffers, allowing it to
write the guest memory with its contents if needed.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 38 ++++++++++++++++++++++++++++++++++++++
 hw/virtio/vhost-shadow-virtqueue.h |  4 ++++
 hw/virtio/vhost-vdpa.c             | 31 +++++++++++++++++++++++++++++--
 3 files changed, 71 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@ static void vhost_handle_guest_kick(EventNotifier *n)
 }
 
 /**
+ * Forward vhost notifications
+ *
+ * @n: hdev call event notifier, the one that device set to notify svq.
+ */
+static void vhost_svq_handle_call(EventNotifier *n)
+{
+    VhostShadowVirtqueue *svq = container_of(n, VhostShadowVirtqueue,
+                                             hdev_call);
+    event_notifier_test_and_clear(n);
+    event_notifier_set(&svq->svq_call);
+}
+
+/**
+ * Set the call notifier for the SVQ to call the guest
+ *
+ * @svq: Shadow virtqueue
+ * @call_fd: call notifier
+ *
+ * Called on BQL context.
+ */
+void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd)
+{
+    if (call_fd == VHOST_FILE_UNBIND) {
+        /*
+         * Fail event_notifier_set if called handling device call.
+         *
+         * SVQ still needs device notifications, since it needs to keep
+         * forwarding used buffers even with the unbind.
+         */
+        memset(&svq->svq_call, 0, sizeof(svq->svq_call));
+    } else {
+        event_notifier_init_fd(&svq->svq_call, call_fd);
+    }
+}
+
+/**
  * Set a new file descriptor for the guest to kick the SVQ and notify for avail
  *
  * @svq: The svq
@@ -XXX,XX +XXX,XX @@ VhostShadowVirtqueue *vhost_svq_new(void)
     }
 
     event_notifier_init_fd(&svq->svq_kick, VHOST_FILE_UNBIND);
+    event_notifier_set_handler(&svq->hdev_call, vhost_svq_handle_call);
     return g_steal_pointer(&svq);
 
 err_init_hdev_call:
@@ -XXX,XX +XXX,XX @@ void vhost_svq_free(gpointer pvq)
     VhostShadowVirtqueue *vq = pvq;
     vhost_svq_stop(vq);
     event_notifier_cleanup(&vq->hdev_kick);
+    event_notifier_set_handler(&vq->hdev_call, NULL);
     event_notifier_cleanup(&vq->hdev_call);
     g_free(vq);
 }
diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.h
+++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
      * So shadow virtqueue must not clean it, or we would lose VirtQueue one.
      */
     EventNotifier svq_kick;
+
+    /* Guest's call notifier, where the SVQ calls guest. */
+    EventNotifier svq_call;
 } VhostShadowVirtqueue;
 
 void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd);
+void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd);
 
 void vhost_svq_stop(VhostShadowVirtqueue *svq);
 
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_kick(struct vhost_dev *dev,
     return vhost_vdpa_call(dev, VHOST_SET_VRING_KICK, file);
 }
 
+static int vhost_vdpa_set_vring_dev_call(struct vhost_dev *dev,
+                                         struct vhost_vring_file *file)
+{
+    trace_vhost_vdpa_set_vring_call(dev, file->index, file->fd);
+    return vhost_vdpa_call(dev, VHOST_SET_VRING_CALL, file);
+}
+
 /**
  * Set the shadow virtqueue descriptors to the device
  *
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_kick(struct vhost_dev *dev,
  * @svq: The shadow virtqueue
  * @idx: The index of the virtqueue in the vhost device
  * @errp: Error
+ *
+ * Note that this function does not rewind kick file descriptor if cannot set
+ * call one.
  */
 static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
                                  VhostShadowVirtqueue *svq, unsigned idx,
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
     r = vhost_vdpa_set_vring_dev_kick(dev, &file);
     if (unlikely(r != 0)) {
         error_setg_errno(errp, -r, "Can't set device kick fd");
+        return false;
+    }
+
+    event_notifier = &svq->hdev_call;
+    file.fd = event_notifier_get_fd(event_notifier);
+    r = vhost_vdpa_set_vring_dev_call(dev, &file);
+    if (unlikely(r != 0)) {
+        error_setg_errno(errp, -r, "Can't set device call fd");
     }
 
     return r == 0;
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_kick(struct vhost_dev *dev,
 static int vhost_vdpa_set_vring_call(struct vhost_dev *dev,
                                        struct vhost_vring_file *file)
 {
-    trace_vhost_vdpa_set_vring_call(dev, file->index, file->fd);
-    return vhost_vdpa_call(dev, VHOST_SET_VRING_CALL, file);
+    struct vhost_vdpa *v = dev->opaque;
+
+    if (v->shadow_vqs_enabled) {
+        int vdpa_idx = file->index - dev->vq_index;
+        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, vdpa_idx);
+
+        vhost_svq_set_svq_call_fd(svq, file->fd);
+        return 0;
+    } else {
+        return vhost_vdpa_set_vring_dev_call(dev, file);
+    }
 }
 
 static int vhost_vdpa_get_features(struct vhost_dev *dev,
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

This allows SVQ to negotiate features with the guest and the device. For
the device, SVQ is a driver. While this function bypasses all
non-transport features, it needs to disable the features that SVQ does
not support when forwarding buffers. This includes packed vq layout,
indirect descriptors or event idx.

Future changes can add support to offer more features to the guest,
since the use of VirtQueue gives this for free. This is left out at the
moment for simplicity.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 44 ++++++++++++++++++++++++++++++++++++++
 hw/virtio/vhost-shadow-virtqueue.h |  2 ++
 hw/virtio/vhost-vdpa.c             | 15 +++++++++++++
 3 files changed, 61 insertions(+)

From: Eugenio Pérez <eperezma@redhat.com>

It reports the shadow virtqueue address from qemu virtual address space.

Since this will be different from the guest's vaddr, but the device can
access it, SVQ takes special care about its alignment & lack of garbage
data. It assumes that IOMMU will work in host_page_size ranges for that.

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd)
 }
 
 /**
+ * Get the shadow vq vring address.
+ * @svq: Shadow virtqueue
+ * @addr: Destination to store address
+ */
+void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
+                              struct vhost_vring_addr *addr)
+{
+    addr->desc_user_addr = (uint64_t)(intptr_t)svq->vring.desc;
+    addr->avail_user_addr = (uint64_t)(intptr_t)svq->vring.avail;
+    addr->used_user_addr = (uint64_t)(intptr_t)svq->vring.used;
+}
+
+size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq)
+{
+    size_t desc_size = sizeof(vring_desc_t) * svq->vring.num;
+    size_t avail_size = offsetof(vring_avail_t, ring) +
+                                             sizeof(uint16_t) * svq->vring.num;
+
+    return ROUND_UP(desc_size + avail_size, qemu_real_host_page_size);
+}
+
+size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq)
+{
+    size_t used_size = offsetof(vring_used_t, ring) +
+                                    sizeof(vring_used_elem_t) * svq->vring.num;
+    return ROUND_UP(used_size, qemu_real_host_page_size);
+}
+
+/**
  * Set a new file descriptor for the guest to kick the SVQ and notify for avail
  *
  * @svq: The svq
diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.h
+++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@
 #define VHOST_SHADOW_VIRTQUEUE_H
 
 #include "qemu/event_notifier.h"
+#include "hw/virtio/virtio.h"
+#include "standard-headers/linux/vhost_types.h"
 
 /* Shadow virtqueue to relay notifications */
 typedef struct VhostShadowVirtqueue {
+    /* Shadow vring */
+    struct vring vring;
+
     /* Shadow kick notifier, sent to vhost */
     EventNotifier hdev_kick;
     /* Shadow call notifier, sent to vhost */
@@ -XXX,XX +XXX,XX @@ bool vhost_svq_valid_features(uint64_t features, Error **errp);
 
 void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd);
 void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd);
+void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
+                              struct vhost_vring_addr *addr);
+size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq);
+size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq);
 
 void vhost_svq_stop(VhostShadowVirtqueue *svq);
 
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

First half of the buffers forwarding part, preparing vhost-vdpa
callbacks to SVQ to offer it. QEMU cannot enable it at this moment, so
this is effectively dead code at the moment, but it helps to reduce
patch size.

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_get_config(struct vhost_dev *dev, uint8_t *config,
     return ret;
  }
 
+static int vhost_vdpa_set_dev_vring_base(struct vhost_dev *dev,
+                                         struct vhost_vring_state *ring)
+{
+    trace_vhost_vdpa_set_vring_base(dev, ring->index, ring->num);
+    return vhost_vdpa_call(dev, VHOST_SET_VRING_BASE, ring);
+}
+
 static int vhost_vdpa_set_vring_dev_kick(struct vhost_dev *dev,
                                          struct vhost_vring_file *file)
 {
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_call(struct vhost_dev *dev,
     return vhost_vdpa_call(dev, VHOST_SET_VRING_CALL, file);
 }
 
+static int vhost_vdpa_set_vring_dev_addr(struct vhost_dev *dev,
+                                         struct vhost_vring_addr *addr)
+{
+    trace_vhost_vdpa_set_vring_addr(dev, addr->index, addr->flags,
+                                addr->desc_user_addr, addr->used_user_addr,
+                                addr->avail_user_addr,
+                                addr->log_guest_addr);
+
+    return vhost_vdpa_call(dev, VHOST_SET_VRING_ADDR, addr);
+
+}
+
 /**
  * Set the shadow virtqueue descriptors to the device
  *
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_log_base(struct vhost_dev *dev, uint64_t base,
 static int vhost_vdpa_set_vring_addr(struct vhost_dev *dev,
                                        struct vhost_vring_addr *addr)
 {
-    trace_vhost_vdpa_set_vring_addr(dev, addr->index, addr->flags,
-                                    addr->desc_user_addr, addr->used_user_addr,
-                                    addr->avail_user_addr,
-                                    addr->log_guest_addr);
-    return vhost_vdpa_call(dev, VHOST_SET_VRING_ADDR, addr);
+    struct vhost_vdpa *v = dev->opaque;
+
+    if (v->shadow_vqs_enabled) {
+        /*
+         * Device vring addr was set at device start. SVQ base is handled by
+         * VirtQueue code.
+         */
+        return 0;
+    }
+
+    return vhost_vdpa_set_vring_dev_addr(dev, addr);
 }
 
 static int vhost_vdpa_set_vring_num(struct vhost_dev *dev,
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_num(struct vhost_dev *dev,
 static int vhost_vdpa_set_vring_base(struct vhost_dev *dev,
                                        struct vhost_vring_state *ring)
 {
-    trace_vhost_vdpa_set_vring_base(dev, ring->index, ring->num);
-    return vhost_vdpa_call(dev, VHOST_SET_VRING_BASE, ring);
+    struct vhost_vdpa *v = dev->opaque;
+
+    if (v->shadow_vqs_enabled) {
+        /*
+         * Device vring base was set at device start. SVQ base is handled by
+         * VirtQueue code.
+         */
+        return 0;
+    }
+
+    return vhost_vdpa_set_dev_vring_base(dev, ring);
 }
 
 static int vhost_vdpa_get_vring_base(struct vhost_dev *dev,
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

Initial version of shadow virtqueue that actually forward buffers. There
is no iommu support at the moment, and that will be addressed in future
patches of this series. Since all vhost-vdpa devices use forced IOMMU,
this means that SVQ is not usable at this point of the series on any
device.

For simplicity it only supports modern devices, that expects vring
in little endian, with split ring and no event idx or indirect
descriptors. Support for them will not be added in this series.

It reuses the VirtQueue code for the device part. The driver part is
based on Linux's virtio_ring driver, but with stripped functionality
and optimizations so it's easier to review.

However, forwarding buffers have some particular pieces: One of the most
unexpected ones is that a guest's buffer can expand through more than
one descriptor in SVQ. While this is handled gracefully by qemu's
emulated virtio devices, it may cause unexpected SVQ queue full. This
patch also solves it by checking for this condition at both guest's
kicks and device's calls. The code may be more elegant in the future if
SVQ code runs in its own iocontext.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 352 ++++++++++++++++++++++++++++++++++++-
 hw/virtio/vhost-shadow-virtqueue.h |  26 +++
 hw/virtio/vhost-vdpa.c             | 155 +++++++++++++++-
 3 files changed, 522 insertions(+), 11 deletions(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qemu/main-loop.h"
+#include "qemu/log.h"
+#include "qemu/memalign.h"
 #include "linux-headers/linux/vhost.h"
 
 /**
@@ -XXX,XX +XXX,XX @@ bool vhost_svq_valid_features(uint64_t features, Error **errp)
 }
 
 /**
- * Forward guest notifications.
+ * Number of descriptors that the SVQ can make available from the guest.
+ *
+ * @svq: The svq
+ */
+static uint16_t vhost_svq_available_slots(const VhostShadowVirtqueue *svq)
+{
+    return svq->vring.num - (svq->shadow_avail_idx - svq->shadow_used_idx);
+}
+
+static void vhost_vring_write_descs(VhostShadowVirtqueue *svq,
+                                    const struct iovec *iovec, size_t num,
+                                    bool more_descs, bool write)
+{
+    uint16_t i = svq->free_head, last = svq->free_head;
+    unsigned n;
+    uint16_t flags = write ? cpu_to_le16(VRING_DESC_F_WRITE) : 0;
+    vring_desc_t *descs = svq->vring.desc;
+
+    if (num == 0) {
+        return;
+    }
+
+    for (n = 0; n < num; n++) {
+        if (more_descs || (n + 1 < num)) {
+            descs[i].flags = flags | cpu_to_le16(VRING_DESC_F_NEXT);
+        } else {
+            descs[i].flags = flags;
+        }
+        descs[i].addr = cpu_to_le64((hwaddr)(intptr_t)iovec[n].iov_base);
+        descs[i].len = cpu_to_le32(iovec[n].iov_len);
+
+        last = i;
+        i = cpu_to_le16(descs[i].next);
+    }
+
+    svq->free_head = le16_to_cpu(descs[last].next);
+}
+
+static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
+                                VirtQueueElement *elem, unsigned *head)
+{
+    unsigned avail_idx;
+    vring_avail_t *avail = svq->vring.avail;
+
+    *head = svq->free_head;
+
+    /* We need some descriptors here */
+    if (unlikely(!elem->out_num && !elem->in_num)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Guest provided element with no descriptors");
+        return false;
+    }
+
+    vhost_vring_write_descs(svq, elem->out_sg, elem->out_num, elem->in_num > 0,
+                            false);
+    vhost_vring_write_descs(svq, elem->in_sg, elem->in_num, false, true);
+
+    /*
+     * Put the entry in the available array (but don't update avail->idx until
+     * they do sync).
+     */
+    avail_idx = svq->shadow_avail_idx & (svq->vring.num - 1);
+    avail->ring[avail_idx] = cpu_to_le16(*head);
+    svq->shadow_avail_idx++;
+
+    /* Update the avail index after write the descriptor */
+    smp_wmb();
+    avail->idx = cpu_to_le16(svq->shadow_avail_idx);
+
+    return true;
+}
+
+static bool vhost_svq_add(VhostShadowVirtqueue *svq, VirtQueueElement *elem)
+{
+    unsigned qemu_head;
+    bool ok = vhost_svq_add_split(svq, elem, &qemu_head);
+    if (unlikely(!ok)) {
+        return false;
+    }
+
+    svq->ring_id_maps[qemu_head] = elem;
+    return true;
+}
+
+static void vhost_svq_kick(VhostShadowVirtqueue *svq)
+{
+    /*
+     * We need to expose the available array entries before checking the used
+     * flags
+     */
+    smp_mb();
+    if (svq->vring.used->flags & VRING_USED_F_NO_NOTIFY) {
+        return;
+    }
+
+    event_notifier_set(&svq->hdev_kick);
+}
+
+/**
+ * Forward available buffers.
+ *
+ * @svq: Shadow VirtQueue
+ *
+ * Note that this function does not guarantee that all guest's available
+ * buffers are available to the device in SVQ avail ring. The guest may have
+ * exposed a GPA / GIOVA contiguous buffer, but it may not be contiguous in
+ * qemu vaddr.
+ *
+ * If that happens, guest's kick notifications will be disabled until the
+ * device uses some buffers.
+ */
+static void vhost_handle_guest_kick(VhostShadowVirtqueue *svq)
+{
+    /* Clear event notifier */
+    event_notifier_test_and_clear(&svq->svq_kick);
+
+    /* Forward to the device as many available buffers as possible */
+    do {
+        virtio_queue_set_notification(svq->vq, false);
+
+        while (true) {
+            VirtQueueElement *elem;
+            bool ok;
+
+            if (svq->next_guest_avail_elem) {
+                elem = g_steal_pointer(&svq->next_guest_avail_elem);
+            } else {
+                elem = virtqueue_pop(svq->vq, sizeof(*elem));
+            }
+
+            if (!elem) {
+                break;
+            }
+
+            if (elem->out_num + elem->in_num > vhost_svq_available_slots(svq)) {
+                /*
+                 * This condition is possible since a contiguous buffer in GPA
+                 * does not imply a contiguous buffer in qemu's VA
+                 * scatter-gather segments. If that happens, the buffer exposed
+                 * to the device needs to be a chain of descriptors at this
+                 * moment.
+                 *
+                 * SVQ cannot hold more available buffers if we are here:
+                 * queue the current guest descriptor and ignore further kicks
+                 * until some elements are used.
+                 */
+                svq->next_guest_avail_elem = elem;
+                return;
+            }
+
+            ok = vhost_svq_add(svq, elem);
+            if (unlikely(!ok)) {
+                /* VQ is broken, just return and ignore any other kicks */
+                return;
+            }
+            vhost_svq_kick(svq);
+        }
+
+        virtio_queue_set_notification(svq->vq, true);
+    } while (!virtio_queue_empty(svq->vq));
+}
+
+/**
+ * Handle guest's kick.
  *
  * @n: guest kick event notifier, the one that guest set to notify svq.
  */
-static void vhost_handle_guest_kick(EventNotifier *n)
+static void vhost_handle_guest_kick_notifier(EventNotifier *n)
 {
     VhostShadowVirtqueue *svq = container_of(n, VhostShadowVirtqueue, svq_kick);
     event_notifier_test_and_clear(n);
-    event_notifier_set(&svq->hdev_kick);
+    vhost_handle_guest_kick(svq);
+}
+
+static bool vhost_svq_more_used(VhostShadowVirtqueue *svq)
+{
+    if (svq->last_used_idx != svq->shadow_used_idx) {
+        return true;
+    }
+
+    svq->shadow_used_idx = cpu_to_le16(svq->vring.used->idx);
+
+    return svq->last_used_idx != svq->shadow_used_idx;
 }
 
 /**
- * Forward vhost notifications
+ * Enable vhost device calls after disable them.
+ *
+ * @svq: The svq
+ *
+ * It returns false if there are pending used buffers from the vhost device,
+ * avoiding the possible races between SVQ checking for more work and enabling
+ * callbacks. True if SVQ used vring has no more pending buffers.
+ */
+static bool vhost_svq_enable_notification(VhostShadowVirtqueue *svq)
+{
+    svq->vring.avail->flags &= ~cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
+    /* Make sure the flag is written before the read of used_idx */
+    smp_mb();
+    return !vhost_svq_more_used(svq);
+}
+
+static void vhost_svq_disable_notification(VhostShadowVirtqueue *svq)
+{
+    svq->vring.avail->flags |= cpu_to_le16(VRING_AVAIL_F_NO_INTERRUPT);
+}
+
+static VirtQueueElement *vhost_svq_get_buf(VhostShadowVirtqueue *svq,
+                                           uint32_t *len)
+{
+    vring_desc_t *descs = svq->vring.desc;
+    const vring_used_t *used = svq->vring.used;
+    vring_used_elem_t used_elem;
+    uint16_t last_used;
+
+    if (!vhost_svq_more_used(svq)) {
+        return NULL;
+    }
+
+    /* Only get used array entries after they have been exposed by dev */
+    smp_rmb();
+    last_used = svq->last_used_idx & (svq->vring.num - 1);
+    used_elem.id = le32_to_cpu(used->ring[last_used].id);
+    used_elem.len = le32_to_cpu(used->ring[last_used].len);
+
+    svq->last_used_idx++;
+    if (unlikely(used_elem.id >= svq->vring.num)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Device %s says index %u is used",
+                      svq->vdev->name, used_elem.id);
+        return NULL;
+    }
+
+    if (unlikely(!svq->ring_id_maps[used_elem.id])) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "Device %s says index %u is used, but it was not available",
+            svq->vdev->name, used_elem.id);
+        return NULL;
+    }
+
+    descs[used_elem.id].next = svq->free_head;
+    svq->free_head = used_elem.id;
+
+    *len = used_elem.len;
+    return g_steal_pointer(&svq->ring_id_maps[used_elem.id]);
+}
+
+static void vhost_svq_flush(VhostShadowVirtqueue *svq,
+                            bool check_for_avail_queue)
+{
+    VirtQueue *vq = svq->vq;
+
+    /* Forward as many used buffers as possible. */
+    do {
+        unsigned i = 0;
+
+        vhost_svq_disable_notification(svq);
+        while (true) {
+            uint32_t len;
+            g_autofree VirtQueueElement *elem = vhost_svq_get_buf(svq, &len);
+            if (!elem) {
+                break;
+            }
+
+            if (unlikely(i >= svq->vring.num)) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                         "More than %u used buffers obtained in a %u size SVQ",
+                         i, svq->vring.num);
+                virtqueue_fill(vq, elem, len, i);
+                virtqueue_flush(vq, i);
+                return;
+            }
+            virtqueue_fill(vq, elem, len, i++);
+        }
+
+        virtqueue_flush(vq, i);
+        event_notifier_set(&svq->svq_call);
+
+        if (check_for_avail_queue && svq->next_guest_avail_elem) {
+            /*
+             * Avail ring was full when vhost_svq_flush was called, so it's a
+             * good moment to make more descriptors available if possible.
+             */
+            vhost_handle_guest_kick(svq);
+        }
+    } while (!vhost_svq_enable_notification(svq));
+}
+
+/**
+ * Forward used buffers.
  *
  * @n: hdev call event notifier, the one that device set to notify svq.
+ *
+ * Note that we are not making any buffers available in the loop, there is no
+ * way that it runs more than virtqueue size times.
  */
 static void vhost_svq_handle_call(EventNotifier *n)
 {
     VhostShadowVirtqueue *svq = container_of(n, VhostShadowVirtqueue,
                                              hdev_call);
     event_notifier_test_and_clear(n);
-    event_notifier_set(&svq->svq_call);
+    vhost_svq_flush(svq, true);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd)
     if (poll_start) {
         event_notifier_init_fd(svq_kick, svq_kick_fd);
         event_notifier_set(svq_kick);
-        event_notifier_set_handler(svq_kick, vhost_handle_guest_kick);
+        event_notifier_set_handler(svq_kick, vhost_handle_guest_kick_notifier);
+    }
+}
+
+/**
+ * Start the shadow virtqueue operation.
+ *
+ * @svq: Shadow Virtqueue
+ * @vdev: VirtIO device
+ * @vq: Virtqueue to shadow
+ */
+void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
+                     VirtQueue *vq)
+{
+    size_t desc_size, driver_size, device_size;
+
+    svq->next_guest_avail_elem = NULL;
+    svq->shadow_avail_idx = 0;
+    svq->shadow_used_idx = 0;
+    svq->last_used_idx = 0;
+    svq->vdev = vdev;
+    svq->vq = vq;
+
+    svq->vring.num = virtio_queue_get_num(vdev, virtio_get_queue_index(vq));
+    driver_size = vhost_svq_driver_area_size(svq);
+    device_size = vhost_svq_device_area_size(svq);
+    svq->vring.desc = qemu_memalign(qemu_real_host_page_size, driver_size);
+    desc_size = sizeof(vring_desc_t) * svq->vring.num;
+    svq->vring.avail = (void *)((char *)svq->vring.desc + desc_size);
+    memset(svq->vring.desc, 0, driver_size);
+    svq->vring.used = qemu_memalign(qemu_real_host_page_size, device_size);
+    memset(svq->vring.used, 0, device_size);
+    svq->ring_id_maps = g_new0(VirtQueueElement *, svq->vring.num);
+    for (unsigned i = 0; i < svq->vring.num - 1; i++) {
+        svq->vring.desc[i].next = cpu_to_le16(i + 1);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd)
 void vhost_svq_stop(VhostShadowVirtqueue *svq)
 {
     event_notifier_set_handler(&svq->svq_kick, NULL);
+    g_autofree VirtQueueElement *next_avail_elem = NULL;
+
+    if (!svq->vq) {
+        return;
+    }
+
+    /* Send all pending used descriptors to guest */
+    vhost_svq_flush(svq, false);
+
+    for (unsigned i = 0; i < svq->vring.num; ++i) {
+        g_autofree VirtQueueElement *elem = NULL;
+        elem = g_steal_pointer(&svq->ring_id_maps[i]);
+        if (elem) {
+            virtqueue_detach_element(svq->vq, elem, 0);
+        }
+    }
+
+    next_avail_elem = g_steal_pointer(&svq->next_guest_avail_elem);
+    if (next_avail_elem) {
+        virtqueue_detach_element(svq->vq, next_avail_elem, 0);
+    }
+    svq->vq = NULL;
+    g_free(svq->ring_id_maps);
+    qemu_vfree(svq->vring.desc);
+    qemu_vfree(svq->vring.used);
 }
 
 /**
diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.h
+++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
 
     /* Guest's call notifier, where the SVQ calls guest. */
     EventNotifier svq_call;
+
+    /* Virtio queue shadowing */
+    VirtQueue *vq;
+
+    /* Virtio device */
+    VirtIODevice *vdev;
+
+    /* Map for use the guest's descriptors */
+    VirtQueueElement **ring_id_maps;
+
+    /* Next VirtQueue element that guest made available */
+    VirtQueueElement *next_guest_avail_elem;
+
+    /* Next head to expose to the device */
+    uint16_t shadow_avail_idx;
+
+    /* Next free descriptor */
+    uint16_t free_head;
+
+    /* Last seen used idx */
+    uint16_t shadow_used_idx;
+
+    /* Next head to consume from the device */
+    uint16_t last_used_idx;
 } VhostShadowVirtqueue;
 
 bool vhost_svq_valid_features(uint64_t features, Error **errp);
@@ -XXX,XX +XXX,XX @@ void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
 size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq);
 size_t vhost_svq_device_area_size(const VhostShadowVirtqueue *svq);
 
+void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
+                     VirtQueue *vq);
 void vhost_svq_stop(VhostShadowVirtqueue *svq);
 
 VhostShadowVirtqueue *vhost_svq_new(void);
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_dev_addr(struct vhost_dev *dev,
  * Note that this function does not rewind kick file descriptor if cannot set
  * call one.
  */
-static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
-                                 VhostShadowVirtqueue *svq, unsigned idx,
-                                 Error **errp)
+static int vhost_vdpa_svq_set_fds(struct vhost_dev *dev,
+                                  VhostShadowVirtqueue *svq, unsigned idx,
+                                  Error **errp)
 {
     struct vhost_vring_file file = {
         .index = dev->vq_index + idx,
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
     r = vhost_vdpa_set_vring_dev_kick(dev, &file);
     if (unlikely(r != 0)) {
         error_setg_errno(errp, -r, "Can't set device kick fd");
-        return false;
+        return r;
     }
 
     event_notifier = &svq->hdev_call;
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
         error_setg_errno(errp, -r, "Can't set device call fd");
     }
 
+    return r;
+}
+
+/**
+ * Unmap a SVQ area in the device
+ */
+static bool vhost_vdpa_svq_unmap_ring(struct vhost_vdpa *v, hwaddr iova,
+                                      hwaddr size)
+{
+    int r;
+
+    size = ROUND_UP(size, qemu_real_host_page_size);
+    r = vhost_vdpa_dma_unmap(v, iova, size);
+    return r == 0;
+}
+
+static bool vhost_vdpa_svq_unmap_rings(struct vhost_dev *dev,
+                                       const VhostShadowVirtqueue *svq)
+{
+    struct vhost_vdpa *v = dev->opaque;
+    struct vhost_vring_addr svq_addr;
+    size_t device_size = vhost_svq_device_area_size(svq);
+    size_t driver_size = vhost_svq_driver_area_size(svq);
+    bool ok;
+
+    vhost_svq_get_vring_addr(svq, &svq_addr);
+
+    ok = vhost_vdpa_svq_unmap_ring(v, svq_addr.desc_user_addr, driver_size);
+    if (unlikely(!ok)) {
+        return false;
+    }
+
+    return vhost_vdpa_svq_unmap_ring(v, svq_addr.used_user_addr, device_size);
+}
+
+/**
+ * Map the shadow virtqueue rings in the device
+ *
+ * @dev: The vhost device
+ * @svq: The shadow virtqueue
+ * @addr: Assigned IOVA addresses
+ * @errp: Error pointer
+ */
+static bool vhost_vdpa_svq_map_rings(struct vhost_dev *dev,
+                                     const VhostShadowVirtqueue *svq,
+                                     struct vhost_vring_addr *addr,
+                                     Error **errp)
+{
+    struct vhost_vdpa *v = dev->opaque;
+    size_t device_size = vhost_svq_device_area_size(svq);
+    size_t driver_size = vhost_svq_driver_area_size(svq);
+    int r;
+
+    ERRP_GUARD();
+    vhost_svq_get_vring_addr(svq, addr);
+
+    r = vhost_vdpa_dma_map(v, addr->desc_user_addr, driver_size,
+                           (void *)(uintptr_t)addr->desc_user_addr, true);
+    if (unlikely(r != 0)) {
+        error_setg_errno(errp, -r, "Cannot create vq driver region: ");
+        return false;
+    }
+
+    r = vhost_vdpa_dma_map(v, addr->used_user_addr, device_size,
+                           (void *)(intptr_t)addr->used_user_addr, false);
+    if (unlikely(r != 0)) {
+        error_setg_errno(errp, -r, "Cannot create vq device region: ");
+    }
+
+    return r == 0;
+}
+
+static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
+                                 VhostShadowVirtqueue *svq, unsigned idx,
+                                 Error **errp)
+{
+    uint16_t vq_index = dev->vq_index + idx;
+    struct vhost_vring_state s = {
+        .index = vq_index,
+    };
+    int r;
+
+    r = vhost_vdpa_set_dev_vring_base(dev, &s);
+    if (unlikely(r)) {
+        error_setg_errno(errp, -r, "Cannot set vring base");
+        return false;
+    }
+
+    r = vhost_vdpa_svq_set_fds(dev, svq, idx, errp);
     return r == 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svqs_start(struct vhost_dev *dev)
     }
 
     for (i = 0; i < v->shadow_vqs->len; ++i) {
+        VirtQueue *vq = virtio_get_queue(dev->vdev, dev->vq_index + i);
         VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, i);
+        struct vhost_vring_addr addr = {
+            .index = i,
+        };
+        int r;
         bool ok = vhost_vdpa_svq_setup(dev, svq, i, &err);
         if (unlikely(!ok)) {
-            error_reportf_err(err, "Cannot setup SVQ %u: ", i);
+            goto err;
+        }
+
+        vhost_svq_start(svq, dev->vdev, vq);
+        ok = vhost_vdpa_svq_map_rings(dev, svq, &addr, &err);
+        if (unlikely(!ok)) {
+            goto err_map;
+        }
+
+        /* Override vring GPA set by vhost subsystem */
+        r = vhost_vdpa_set_vring_dev_addr(dev, &addr);
+        if (unlikely(r != 0)) {
+            error_setg_errno(&err, -r, "Cannot set device address");
+            goto err_set_addr;
+        }
+    }
+
+    return true;
+
+err_set_addr:
+    vhost_vdpa_svq_unmap_rings(dev, g_ptr_array_index(v->shadow_vqs, i));
+
+err_map:
+    vhost_svq_stop(g_ptr_array_index(v->shadow_vqs, i));
+
+err:
+    error_reportf_err(err, "Cannot setup SVQ %u: ", i);
+    for (unsigned j = 0; j < i; ++j) {
+        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, j);
+        vhost_vdpa_svq_unmap_rings(dev, svq);
+        vhost_svq_stop(svq);
+    }
+
+    return false;
+}
+
+static bool vhost_vdpa_svqs_stop(struct vhost_dev *dev)
+{
+    struct vhost_vdpa *v = dev->opaque;
+
+    if (!v->shadow_vqs) {
+        return true;
+    }
+
+    for (unsigned i = 0; i < v->shadow_vqs->len; ++i) {
+        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs, i);
+        bool ok = vhost_vdpa_svq_unmap_rings(dev, svq);
+        if (unlikely(!ok)) {
             return false;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
         }
         vhost_vdpa_set_vring_ready(dev);
     } else {
+        ok = vhost_vdpa_svqs_stop(dev);
+        if (unlikely(!ok)) {
+            return -1;
+        }
         vhost_vdpa_host_notifiers_uninit(dev, dev->nvqs);
     }
 
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

This iova tree function allows it to look for a hole in allocated
regions and return a totally new translation for a given translated
address.

It's usage is mainly to allow devices to access qemu address space,
remapping guest's one into a new iova space where qemu can add chunks of
addresses.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/qemu/iova-tree.h |  18 +++++++
 util/iova-tree.c         | 136 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 154 insertions(+)

diff --git a/include/qemu/iova-tree.h b/include/qemu/iova-tree.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/iova-tree.h
+++ b/include/qemu/iova-tree.h
@@ -XXX,XX +XXX,XX @@
 #define  IOVA_OK           (0)
 #define  IOVA_ERR_INVALID  (-1) /* Invalid parameters */
 #define  IOVA_ERR_OVERLAP  (-2) /* IOVA range overlapped */
+#define  IOVA_ERR_NOMEM    (-3) /* Cannot allocate */
 
 typedef struct IOVATree IOVATree;
 typedef struct DMAMap {
@@ -XXX,XX +XXX,XX @@ const DMAMap *iova_tree_find_address(const IOVATree *tree, hwaddr iova);
 void iova_tree_foreach(IOVATree *tree, iova_tree_iterator iterator);
 
 /**
+ * iova_tree_alloc_map:
+ *
+ * @tree: the iova tree to allocate from
+ * @map: the new map (as translated addr & size) to allocate in the iova region
+ * @iova_begin: the minimum address of the allocation
+ * @iova_end: the maximum addressable direction of the allocation
+ *
+ * Allocates a new region of a given size, between iova_min and iova_max.
+ *
+ * Return: Same as iova_tree_insert, but cannot overlap and can return error if
+ * iova tree is out of free contiguous range. The caller gets the assigned iova
+ * in map->iova.
+ */
+int iova_tree_alloc_map(IOVATree *tree, DMAMap *map, hwaddr iova_begin,
+                        hwaddr iova_end);
+
+/**
  * iova_tree_destroy:
  *
  * @tree: the iova tree to destroy
diff --git a/util/iova-tree.c b/util/iova-tree.c
index XXXXXXX..XXXXXXX 100644
--- a/util/iova-tree.c
+++ b/util/iova-tree.c
@@ -XXX,XX +XXX,XX @@ struct IOVATree {
     GTree *tree;
 };
 
+/* Args to pass to iova_tree_alloc foreach function. */
+struct IOVATreeAllocArgs {
+    /* Size of the desired allocation */
+    size_t new_size;
+
+    /* The minimum address allowed in the allocation */
+    hwaddr iova_begin;
+
+    /* Map at the left of the hole, can be NULL if "this" is first one */
+    const DMAMap *prev;
+
+    /* Map at the right of the hole, can be NULL if "prev" is the last one */
+    const DMAMap *this;
+
+    /* If found, we fill in the IOVA here */
+    hwaddr iova_result;
+
+    /* Whether have we found a valid IOVA */
+    bool iova_found;
+};
+
+/**
+ * Iterate args to the next hole
+ *
+ * @args: The alloc arguments
+ * @next: The next mapping in the tree. Can be NULL to signal the last one
+ */
+static void iova_tree_alloc_args_iterate(struct IOVATreeAllocArgs *args,
+                                         const DMAMap *next)
+{
+    args->prev = args->this;
+    args->this = next;
+}
+
 static int iova_tree_compare(gconstpointer a, gconstpointer b, gpointer data)
 {
     const DMAMap *m1 = a, *m2 = b;
@@ -XXX,XX +XXX,XX @@ int iova_tree_remove(IOVATree *tree, const DMAMap *map)
     return IOVA_OK;
 }
 
+/**
+ * Try to find an unallocated IOVA range between prev and this elements.
+ *
+ * @args: Arguments to allocation
+ *
+ * Cases:
+ *
+ * (1) !prev, !this: No entries allocated, always succeed
+ *
+ * (2) !prev, this: We're iterating at the 1st element.
+ *
+ * (3) prev, !this: We're iterating at the last element.
+ *
+ * (4) prev, this: this is the most common case, we'll try to find a hole
+ * between "prev" and "this" mapping.
+ *
+ * Note that this function assumes the last valid iova is HWADDR_MAX, but it
+ * searches linearly so it's easy to discard the result if it's not the case.
+ */
+static void iova_tree_alloc_map_in_hole(struct IOVATreeAllocArgs *args)
+{
+    const DMAMap *prev = args->prev, *this = args->this;
+    uint64_t hole_start, hole_last;
+
+    if (this && this->iova + this->size < args->iova_begin) {
+        return;
+    }
+
+    hole_start = MAX(prev ? prev->iova + prev->size + 1 : 0, args->iova_begin);
+    hole_last = this ? this->iova : HWADDR_MAX;
+
+    if (hole_last - hole_start > args->new_size) {
+        args->iova_result = hole_start;
+        args->iova_found = true;
+    }
+}
+
+/**
+ * Foreach dma node in the tree, compare if there is a hole with its previous
+ * node (or minimum iova address allowed) and the node.
+ *
+ * @key: Node iterating
+ * @value: Node iterating
+ * @pargs: Struct to communicate with the outside world
+ *
+ * Return: false to keep iterating, true if needs break.
+ */
+static gboolean iova_tree_alloc_traverse(gpointer key, gpointer value,
+                                         gpointer pargs)
+{
+    struct IOVATreeAllocArgs *args = pargs;
+    DMAMap *node = value;
+
+    assert(key == value);
+
+    iova_tree_alloc_args_iterate(args, node);
+    iova_tree_alloc_map_in_hole(args);
+    return args->iova_found;
+}
+
+int iova_tree_alloc_map(IOVATree *tree, DMAMap *map, hwaddr iova_begin,
+                        hwaddr iova_last)
+{
+    struct IOVATreeAllocArgs args = {
+        .new_size = map->size,
+        .iova_begin = iova_begin,
+    };
+
+    if (unlikely(iova_last < iova_begin)) {
+        return IOVA_ERR_INVALID;
+    }
+
+    /*
+     * Find a valid hole for the mapping
+     *
+     * Assuming low iova_begin, so no need to do a binary search to
+     * locate the first node.
+     *
+     * TODO: Replace all this with g_tree_node_first/next/last when available
+     * (from glib since 2.68). To do it with g_tree_foreach complicates the
+     * code a lot.
+     *
+     */
+    g_tree_foreach(tree->tree, iova_tree_alloc_traverse, &args);
+    if (!args.iova_found) {
+        /*
+         * Either tree is empty or the last hole is still not checked.
+         * g_tree_foreach does not compare (last, iova_last] range, so we check
+         * it here.
+         */
+        iova_tree_alloc_args_iterate(&args, NULL);
+        iova_tree_alloc_map_in_hole(&args);
+    }
+
+    if (!args.iova_found || args.iova_result + map->size > iova_last) {
+        return IOVA_ERR_NOMEM;
+    }
+
+    map->iova = args.iova_result;
+    return iova_tree_insert(tree, map);
+}
+
 void iova_tree_destroy(IOVATree *tree)
 {
     g_tree_destroy(tree->tree);
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

This function does the reverse operation of iova_tree_find: To look for
a mapping that match a translated address so we can do the reverse.

This have linear complexity instead of logarithmic, but it supports
overlapping HVA. Future developments could reduce it.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/qemu/iova-tree.h | 20 +++++++++++++++++++-
 util/iova-tree.c         | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/include/qemu/iova-tree.h b/include/qemu/iova-tree.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/iova-tree.h
+++ b/include/qemu/iova-tree.h
@@ -XXX,XX +XXX,XX @@ int iova_tree_remove(IOVATree *tree, const DMAMap *map);
  * @tree: the iova tree to search from
  * @map: the mapping to search
  *
- * Search for a mapping in the iova tree that overlaps with the
+ * Search for a mapping in the iova tree that iova overlaps with the
  * mapping range specified.  Only the first found mapping will be
  * returned.
  *
@@ -XXX,XX +XXX,XX @@ int iova_tree_remove(IOVATree *tree, const DMAMap *map);
 const DMAMap *iova_tree_find(const IOVATree *tree, const DMAMap *map);
 
 /**
+ * iova_tree_find_iova:
+ *
+ * @tree: the iova tree to search from
+ * @map: the mapping to search
+ *
+ * Search for a mapping in the iova tree that translated_addr overlaps with the
+ * mapping range specified.  Only the first found mapping will be
+ * returned.
+ *
+ * Return: DMAMap pointer if found, or NULL if not found.  Note that
+ * the returned DMAMap pointer is maintained internally.  User should
+ * only read the content but never modify or free the content.  Also,
+ * user is responsible to make sure the pointer is valid (say, no
+ * concurrent deletion in progress).
+ */
+const DMAMap *iova_tree_find_iova(const IOVATree *tree, const DMAMap *map);
+
+/**
  * iova_tree_find_address:
  *
  * @tree: the iova tree to search from
diff --git a/util/iova-tree.c b/util/iova-tree.c
index XXXXXXX..XXXXXXX 100644
--- a/util/iova-tree.c
+++ b/util/iova-tree.c
@@ -XXX,XX +XXX,XX @@ struct IOVATreeAllocArgs {
     bool iova_found;
 };
 
+typedef struct IOVATreeFindIOVAArgs {
+    const DMAMap *needle;
+    const DMAMap *result;
+} IOVATreeFindIOVAArgs;
+
 /**
  * Iterate args to the next hole
  *
@@ -XXX,XX +XXX,XX @@ const DMAMap *iova_tree_find(const IOVATree *tree, const DMAMap *map)
     return g_tree_lookup(tree->tree, map);
 }
 
+static gboolean iova_tree_find_address_iterator(gpointer key, gpointer value,
+                                                gpointer data)
+{
+    const DMAMap *map = key;
+    IOVATreeFindIOVAArgs *args = data;
+    const DMAMap *needle;
+
+    g_assert(key == value);
+
+    needle = args->needle;
+    if (map->translated_addr + map->size < needle->translated_addr ||
+        needle->translated_addr + needle->size < map->translated_addr) {
+        return false;
+    }
+
+    args->result = map;
+    return true;
+}
+
+const DMAMap *iova_tree_find_iova(const IOVATree *tree, const DMAMap *map)
+{
+    IOVATreeFindIOVAArgs args = {
+        .needle = map,
+    };
+
+    g_tree_foreach(tree->tree, iova_tree_find_address_iterator, &args);
+    return args.result;
+}
+
 const DMAMap *iova_tree_find_address(const IOVATree *tree, hwaddr iova)
 {
     const DMAMap map = { .iova = iova, .size = 0 };
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

This tree is able to look for a translated address from an IOVA address.

At first glance it is similar to util/iova-tree. However, SVQ working on
devices with limited IOVA space need more capabilities, like allocating
IOVA chunks or performing reverse translations (qemu addresses to iova).

The allocation capability, as "assign a free IOVA address to this chunk
of memory in qemu's address space" allows shadow virtqueue to create a
new address space that is not restricted by guest's addressable one, so
we can allocate shadow vqs vrings outside of it.

It duplicates the tree so it can search efficiently in both directions,
and it will signal overlap if iova or the translated address is present
in any tree.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/meson.build       |   2 +-
 hw/virtio/vhost-iova-tree.c | 110 ++++++++++++++++++++++++++++++++++++++++++++
 hw/virtio/vhost-iova-tree.h |  27 +++++++++++
 3 files changed, 138 insertions(+), 1 deletion(-)
 create mode 100644 hw/virtio/vhost-iova-tree.c
 create mode 100644 hw/virtio/vhost-iova-tree.h

diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ALL', if_true: files('vhost-stub.c'))
 
 virtio_ss = ss.source_set()
 virtio_ss.add(files('virtio.c'))
-virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c', 'vhost-shadow-virtqueue.c'))
+virtio_ss.add(when: 'CONFIG_VHOST', if_true: files('vhost.c', 'vhost-backend.c', 'vhost-shadow-virtqueue.c', 'vhost-iova-tree.c'))
 virtio_ss.add(when: 'CONFIG_VHOST_USER', if_true: files('vhost-user.c'))
 virtio_ss.add(when: 'CONFIG_VHOST_VDPA', if_true: files('vhost-vdpa.c'))
 virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-balloon.c'))
diff --git a/hw/virtio/vhost-iova-tree.c b/hw/virtio/vhost-iova-tree.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/virtio/vhost-iova-tree.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * vhost software live migration iova tree
+ *
+ * SPDX-FileCopyrightText: Red Hat, Inc. 2021
+ * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/iova-tree.h"
+#include "vhost-iova-tree.h"
+
+#define iova_min_addr qemu_real_host_page_size
+
+/**
+ * VhostIOVATree, able to:
+ * - Translate iova address
+ * - Reverse translate iova address (from translated to iova)
+ * - Allocate IOVA regions for translated range (linear operation)
+ */
+struct VhostIOVATree {
+    /* First addressable iova address in the device */
+    uint64_t iova_first;
+
+    /* Last addressable iova address in the device */
+    uint64_t iova_last;
+
+    /* IOVA address to qemu memory maps. */
+    IOVATree *iova_taddr_map;
+};
+
+/**
+ * Create a new IOVA tree
+ *
+ * Returns the new IOVA tree
+ */
+VhostIOVATree *vhost_iova_tree_new(hwaddr iova_first, hwaddr iova_last)
+{
+    VhostIOVATree *tree = g_new(VhostIOVATree, 1);
+
+    /* Some devices do not like 0 addresses */
+    tree->iova_first = MAX(iova_first, iova_min_addr);
+    tree->iova_last = iova_last;
+
+    tree->iova_taddr_map = iova_tree_new();
+    return tree;
+}
+
+/**
+ * Delete an iova tree
+ */
+void vhost_iova_tree_delete(VhostIOVATree *iova_tree)
+{
+    iova_tree_destroy(iova_tree->iova_taddr_map);
+    g_free(iova_tree);
+}
+
+/**
+ * Find the IOVA address stored from a memory address
+ *
+ * @tree: The iova tree
+ * @map: The map with the memory address
+ *
+ * Return the stored mapping, or NULL if not found.
+ */
+const DMAMap *vhost_iova_tree_find_iova(const VhostIOVATree *tree,
+                                        const DMAMap *map)
+{
+    return iova_tree_find_iova(tree->iova_taddr_map, map);
+}
+
+/**
+ * Allocate a new mapping
+ *
+ * @tree: The iova tree
+ * @map: The iova map
+ *
+ * Returns:
+ * - IOVA_OK if the map fits in the container
+ * - IOVA_ERR_INVALID if the map does not make sense (like size overflow)
+ * - IOVA_ERR_NOMEM if tree cannot allocate more space.
+ *
+ * It returns assignated iova in map->iova if return value is VHOST_DMA_MAP_OK.
+ */
+int vhost_iova_tree_map_alloc(VhostIOVATree *tree, DMAMap *map)
+{
+    /* Some vhost devices do not like addr 0. Skip first page */
+    hwaddr iova_first = tree->iova_first ?: qemu_real_host_page_size;
+
+    if (map->translated_addr + map->size < map->translated_addr ||
+        map->perm == IOMMU_NONE) {
+        return IOVA_ERR_INVALID;
+    }
+
+    /* Allocate a node in IOVA address */
+    return iova_tree_alloc_map(tree->iova_taddr_map, map, iova_first,
+                               tree->iova_last);
+}
+
+/**
+ * Remove existing mappings from iova tree
+ *
+ * @iova_tree: The vhost iova tree
+ * @map: The map to remove
+ */
+void vhost_iova_tree_remove(VhostIOVATree *iova_tree, const DMAMap *map)
+{
+    iova_tree_remove(iova_tree->iova_taddr_map, map);
+}
diff --git a/hw/virtio/vhost-iova-tree.h b/hw/virtio/vhost-iova-tree.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/virtio/vhost-iova-tree.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * vhost software live migration iova tree
+ *
+ * SPDX-FileCopyrightText: Red Hat, Inc. 2021
+ * SPDX-FileContributor: Author: Eugenio Pérez <eperezma@redhat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_VIRTIO_VHOST_IOVA_TREE_H
+#define HW_VIRTIO_VHOST_IOVA_TREE_H
+
+#include "qemu/iova-tree.h"
+#include "exec/memory.h"
+
+typedef struct VhostIOVATree VhostIOVATree;
+
+VhostIOVATree *vhost_iova_tree_new(uint64_t iova_first, uint64_t iova_last);
+void vhost_iova_tree_delete(VhostIOVATree *iova_tree);
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(VhostIOVATree, vhost_iova_tree_delete);
+
+const DMAMap *vhost_iova_tree_find_iova(const VhostIOVATree *iova_tree,
+                                        const DMAMap *map);
+int vhost_iova_tree_map_alloc(VhostIOVATree *iova_tree, DMAMap *map);
+void vhost_iova_tree_remove(VhostIOVATree *iova_tree, const DMAMap *map);
+
+#endif
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

Use translations added in VhostIOVATree in SVQ.

Only introduce usage here, not allocation and deallocation. As with
previous patches, we use the dead code paths of shadow_vqs_enabled to
avoid commiting too many changes at once. These are impossible to take
at the moment.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c |  86 +++++++++++++++++++++++---
 hw/virtio/vhost-shadow-virtqueue.h |   6 +-
 hw/virtio/vhost-vdpa.c             | 122 +++++++++++++++++++++++++++++++------
 include/hw/virtio/vhost-vdpa.h     |   3 +
 4 files changed, 187 insertions(+), 30 deletions(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -XXX,XX +XXX,XX @@ static uint16_t vhost_svq_available_slots(const VhostShadowVirtqueue *svq)
     return svq->vring.num - (svq->shadow_avail_idx - svq->shadow_used_idx);
 }
 
-static void vhost_vring_write_descs(VhostShadowVirtqueue *svq,
+/**
+ * Translate addresses between the qemu's virtual address and the SVQ IOVA
+ *
+ * @svq: Shadow VirtQueue
+ * @vaddr: Translated IOVA addresses
+ * @iovec: Source qemu's VA addresses
+ * @num: Length of iovec and minimum length of vaddr
+ */
+static bool vhost_svq_translate_addr(const VhostShadowVirtqueue *svq,
+                                     hwaddr *addrs, const struct iovec *iovec,
+                                     size_t num)
+{
+    if (num == 0) {
+        return true;
+    }
+
+    for (size_t i = 0; i < num; ++i) {
+        DMAMap needle = {
+            .translated_addr = (hwaddr)(uintptr_t)iovec[i].iov_base,
+            .size = iovec[i].iov_len,
+        };
+        Int128 needle_last, map_last;
+        size_t off;
+
+        const DMAMap *map = vhost_iova_tree_find_iova(svq->iova_tree, &needle);
+        /*
+         * Map cannot be NULL since iova map contains all guest space and
+         * qemu already has a physical address mapped
+         */
+        if (unlikely(!map)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "Invalid address 0x%"HWADDR_PRIx" given by guest",
+                          needle.translated_addr);
+            return false;
+        }
+
+        off = needle.translated_addr - map->translated_addr;
+        addrs[i] = map->iova + off;
+
+        needle_last = int128_add(int128_make64(needle.translated_addr),
+                                 int128_make64(iovec[i].iov_len));
+        map_last = int128_make64(map->translated_addr + map->size);
+        if (unlikely(int128_gt(needle_last, map_last))) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "Guest buffer expands over iova range");
+            return false;
+        }
+    }
+
+    return true;
+}
+
+static void vhost_vring_write_descs(VhostShadowVirtqueue *svq, hwaddr *sg,
                                     const struct iovec *iovec, size_t num,
                                     bool more_descs, bool write)
 {
@@ -XXX,XX +XXX,XX @@ static void vhost_vring_write_descs(VhostShadowVirtqueue *svq,
         } else {
             descs[i].flags = flags;
         }
-        descs[i].addr = cpu_to_le64((hwaddr)(intptr_t)iovec[n].iov_base);
+        descs[i].addr = cpu_to_le64(sg[n]);
         descs[i].len = cpu_to_le32(iovec[n].iov_len);
 
         last = i;
@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
 {
     unsigned avail_idx;
     vring_avail_t *avail = svq->vring.avail;
+    bool ok;
+    g_autofree hwaddr *sgs = g_new(hwaddr, MAX(elem->out_num, elem->in_num));
 
     *head = svq->free_head;
 
@@ -XXX,XX +XXX,XX @@ static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
         return false;
     }
 
-    vhost_vring_write_descs(svq, elem->out_sg, elem->out_num, elem->in_num > 0,
-                            false);
-    vhost_vring_write_descs(svq, elem->in_sg, elem->in_num, false, true);
+    ok = vhost_svq_translate_addr(svq, sgs, elem->out_sg, elem->out_num);
+    if (unlikely(!ok)) {
+        return false;
+    }
+    vhost_vring_write_descs(svq, sgs, elem->out_sg, elem->out_num,
+                            elem->in_num > 0, false);
+
+
+    ok = vhost_svq_translate_addr(svq, sgs, elem->in_sg, elem->in_num);
+    if (unlikely(!ok)) {
+        return false;
+    }
+
+    vhost_vring_write_descs(svq, sgs, elem->in_sg, elem->in_num, false, true);
 
     /*
      * Put the entry in the available array (but don't update avail->idx until
@@ -XXX,XX +XXX,XX @@ void vhost_svq_set_svq_call_fd(VhostShadowVirtqueue *svq, int call_fd)
 void vhost_svq_get_vring_addr(const VhostShadowVirtqueue *svq,
                               struct vhost_vring_addr *addr)
 {
-    addr->desc_user_addr = (uint64_t)(intptr_t)svq->vring.desc;
-    addr->avail_user_addr = (uint64_t)(intptr_t)svq->vring.avail;
-    addr->used_user_addr = (uint64_t)(intptr_t)svq->vring.used;
+    addr->desc_user_addr = (uint64_t)(uintptr_t)svq->vring.desc;
+    addr->avail_user_addr = (uint64_t)(uintptr_t)svq->vring.avail;
+    addr->used_user_addr = (uint64_t)(uintptr_t)svq->vring.used;
 }
 
 size_t vhost_svq_driver_area_size(const VhostShadowVirtqueue *svq)
@@ -XXX,XX +XXX,XX @@ void vhost_svq_stop(VhostShadowVirtqueue *svq)
  * Creates vhost shadow virtqueue, and instructs the vhost device to use the
  * shadow methods and file descriptors.
  *
+ * @iova_tree: Tree to perform descriptors translations
+ *
  * Returns the new virtqueue or NULL.
  *
  * In case of error, reason is reported through error_report.
  */
-VhostShadowVirtqueue *vhost_svq_new(void)
+VhostShadowVirtqueue *vhost_svq_new(VhostIOVATree *iova_tree)
 {
     g_autofree VhostShadowVirtqueue *svq = g_new0(VhostShadowVirtqueue, 1);
     int r;
@@ -XXX,XX +XXX,XX @@ VhostShadowVirtqueue *vhost_svq_new(void)
 
     event_notifier_init_fd(&svq->svq_kick, VHOST_FILE_UNBIND);
     event_notifier_set_handler(&svq->hdev_call, vhost_svq_handle_call);
+    svq->iova_tree = iova_tree;
     return g_steal_pointer(&svq);
 
 err_init_hdev_call:
diff --git a/hw/virtio/vhost-shadow-virtqueue.h b/hw/virtio/vhost-shadow-virtqueue.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-shadow-virtqueue.h
+++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/event_notifier.h"
 #include "hw/virtio/virtio.h"
 #include "standard-headers/linux/vhost_types.h"
+#include "hw/virtio/vhost-iova-tree.h"
 
 /* Shadow virtqueue to relay notifications */
 typedef struct VhostShadowVirtqueue {
@@ -XXX,XX +XXX,XX @@ typedef struct VhostShadowVirtqueue {
     /* Virtio device */
     VirtIODevice *vdev;
 
+    /* IOVA mapping */
+    VhostIOVATree *iova_tree;
+
     /* Map for use the guest's descriptors */
     VirtQueueElement **ring_id_maps;
 
@@ -XXX,XX +XXX,XX @@ void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
                      VirtQueue *vq);
 void vhost_svq_stop(VhostShadowVirtqueue *svq);
 
-VhostShadowVirtqueue *vhost_svq_new(void);
+VhostShadowVirtqueue *vhost_svq_new(VhostIOVATree *iova_tree);
 
 void vhost_svq_free(gpointer vq);
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(VhostShadowVirtqueue, vhost_svq_free);
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static void vhost_vdpa_listener_region_add(MemoryListener *listener,
                                          vaddr, section->readonly);
 
     llsize = int128_sub(llend, int128_make64(iova));
+    if (v->shadow_vqs_enabled) {
+        DMAMap mem_region = {
+            .translated_addr = (hwaddr)(uintptr_t)vaddr,
+            .size = int128_get64(llsize) - 1,
+            .perm = IOMMU_ACCESS_FLAG(true, section->readonly),
+        };
+
+        int r = vhost_iova_tree_map_alloc(v->iova_tree, &mem_region);
+        if (unlikely(r != IOVA_OK)) {
+            error_report("Can't allocate a mapping (%d)", r);
+            goto fail;
+        }
+
+        iova = mem_region.iova;
+    }
 
     vhost_vdpa_iotlb_batch_begin_once(v);
     ret = vhost_vdpa_dma_map(v, iova, int128_get64(llsize),
@@ -XXX,XX +XXX,XX @@ static void vhost_vdpa_listener_region_del(MemoryListener *listener,
 
     llsize = int128_sub(llend, int128_make64(iova));
 
+    if (v->shadow_vqs_enabled) {
+        const DMAMap *result;
+        const void *vaddr = memory_region_get_ram_ptr(section->mr) +
+            section->offset_within_region +
+            (iova - section->offset_within_address_space);
+        DMAMap mem_region = {
+            .translated_addr = (hwaddr)(uintptr_t)vaddr,
+            .size = int128_get64(llsize) - 1,
+        };
+
+        result = vhost_iova_tree_find_iova(v->iova_tree, &mem_region);
+        iova = result->iova;
+        vhost_iova_tree_remove(v->iova_tree, &mem_region);
+    }
     vhost_vdpa_iotlb_batch_begin_once(v);
     ret = vhost_vdpa_dma_unmap(v, iova, int128_get64(llsize));
     if (ret) {
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
 
     shadow_vqs = g_ptr_array_new_full(hdev->nvqs, vhost_svq_free);
     for (unsigned n = 0; n < hdev->nvqs; ++n) {
-        g_autoptr(VhostShadowVirtqueue) svq = vhost_svq_new();
+        g_autoptr(VhostShadowVirtqueue) svq = vhost_svq_new(v->iova_tree);
 
         if (unlikely(!svq)) {
             error_setg(errp, "Cannot create svq %u", n);
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_svq_set_fds(struct vhost_dev *dev,
 /**
  * Unmap a SVQ area in the device
  */
-static bool vhost_vdpa_svq_unmap_ring(struct vhost_vdpa *v, hwaddr iova,
-                                      hwaddr size)
+static bool vhost_vdpa_svq_unmap_ring(struct vhost_vdpa *v,
+                                      const DMAMap *needle)
 {
+    const DMAMap *result = vhost_iova_tree_find_iova(v->iova_tree, needle);
+    hwaddr size;
     int r;
 
-    size = ROUND_UP(size, qemu_real_host_page_size);
-    r = vhost_vdpa_dma_unmap(v, iova, size);
+    if (unlikely(!result)) {
+        error_report("Unable to find SVQ address to unmap");
+        return false;
+    }
+
+    size = ROUND_UP(result->size, qemu_real_host_page_size);
+    r = vhost_vdpa_dma_unmap(v, result->iova, size);
     return r == 0;
 }
 
 static bool vhost_vdpa_svq_unmap_rings(struct vhost_dev *dev,
                                        const VhostShadowVirtqueue *svq)
 {
+    DMAMap needle = {};
     struct vhost_vdpa *v = dev->opaque;
     struct vhost_vring_addr svq_addr;
-    size_t device_size = vhost_svq_device_area_size(svq);
-    size_t driver_size = vhost_svq_driver_area_size(svq);
     bool ok;
 
     vhost_svq_get_vring_addr(svq, &svq_addr);
 
-    ok = vhost_vdpa_svq_unmap_ring(v, svq_addr.desc_user_addr, driver_size);
+    needle.translated_addr = svq_addr.desc_user_addr;
+    ok = vhost_vdpa_svq_unmap_ring(v, &needle);
     if (unlikely(!ok)) {
         return false;
     }
 
-    return vhost_vdpa_svq_unmap_ring(v, svq_addr.used_user_addr, device_size);
+    needle.translated_addr = svq_addr.used_user_addr;
+    return vhost_vdpa_svq_unmap_ring(v, &needle);
+}
+
+/**
+ * Map the SVQ area in the device
+ *
+ * @v: Vhost-vdpa device
+ * @needle: The area to search iova
+ * @errorp: Error pointer
+ */
+static bool vhost_vdpa_svq_map_ring(struct vhost_vdpa *v, DMAMap *needle,
+                                    Error **errp)
+{
+    int r;
+
+    r = vhost_iova_tree_map_alloc(v->iova_tree, needle);
+    if (unlikely(r != IOVA_OK)) {
+        error_setg(errp, "Cannot allocate iova (%d)", r);
+        return false;
+    }
+
+    r = vhost_vdpa_dma_map(v, needle->iova, needle->size + 1,
+                           (void *)(uintptr_t)needle->translated_addr,
+                           needle->perm == IOMMU_RO);
+    if (unlikely(r != 0)) {
+        error_setg_errno(errp, -r, "Cannot map region to device");
+        vhost_iova_tree_remove(v->iova_tree, needle);
+    }
+
+    return r == 0;
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_svq_map_rings(struct vhost_dev *dev,
                                      struct vhost_vring_addr *addr,
                                      Error **errp)
 {
+    DMAMap device_region, driver_region;
+    struct vhost_vring_addr svq_addr;
     struct vhost_vdpa *v = dev->opaque;
     size_t device_size = vhost_svq_device_area_size(svq);
     size_t driver_size = vhost_svq_driver_area_size(svq);
-    int r;
+    size_t avail_offset;
+    bool ok;
 
     ERRP_GUARD();
-    vhost_svq_get_vring_addr(svq, addr);
+    vhost_svq_get_vring_addr(svq, &svq_addr);
 
-    r = vhost_vdpa_dma_map(v, addr->desc_user_addr, driver_size,
-                           (void *)(uintptr_t)addr->desc_user_addr, true);
-    if (unlikely(r != 0)) {
-        error_setg_errno(errp, -r, "Cannot create vq driver region: ");
+    driver_region = (DMAMap) {
+        .translated_addr = svq_addr.desc_user_addr,
+        .size = driver_size - 1,
+        .perm = IOMMU_RO,
+    };
+    ok = vhost_vdpa_svq_map_ring(v, &driver_region, errp);
+    if (unlikely(!ok)) {
+        error_prepend(errp, "Cannot create vq driver region: ");
         return false;
     }
+    addr->desc_user_addr = driver_region.iova;
+    avail_offset = svq_addr.avail_user_addr - svq_addr.desc_user_addr;
+    addr->avail_user_addr = driver_region.iova + avail_offset;
 
-    r = vhost_vdpa_dma_map(v, addr->used_user_addr, device_size,
-                           (void *)(intptr_t)addr->used_user_addr, false);
-    if (unlikely(r != 0)) {
-        error_setg_errno(errp, -r, "Cannot create vq device region: ");
+    device_region = (DMAMap) {
+        .translated_addr = svq_addr.used_user_addr,
+        .size = device_size - 1,
+        .perm = IOMMU_RW,
+    };
+    ok = vhost_vdpa_svq_map_ring(v, &device_region, errp);
+    if (unlikely(!ok)) {
+        error_prepend(errp, "Cannot create vq device region: ");
+        vhost_vdpa_svq_unmap_ring(v, &driver_region);
     }
+    addr->used_user_addr = device_region.iova;
 
-    return r == 0;
+    return ok;
 }
 
 static bool vhost_vdpa_svq_setup(struct vhost_dev *dev,
diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/vhost-vdpa.h
+++ b/include/hw/virtio/vhost-vdpa.h
@@ -XXX,XX +XXX,XX @@
 
 #include <gmodule.h>
 
+#include "hw/virtio/vhost-iova-tree.h"
 #include "hw/virtio/virtio.h"
 #include "standard-headers/linux/vhost_types.h"
 
@@ -XXX,XX +XXX,XX @@ typedef struct vhost_vdpa {
     MemoryListener listener;
     struct vhost_vdpa_iova_range iova_range;
     bool shadow_vqs_enabled;
+    /* IOVA mapping used by the Shadow Virtqueue */
+    VhostIOVATree *iova_tree;
     GPtrArray *shadow_vqs;
     struct vhost_dev *dev;
     VhostVDPAHostNotifier notifier[VIRTIO_QUEUE_MAX];
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

This is needed to achieve migration, so the destination can restore its
index.

Setting base as last used idx, so destination will see as available all
the entries that the device did not use, including the in-flight
processing ones.

This is ok for networking, but other kinds of devices might have
problems with these retransmissions.

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_base(struct vhost_dev *dev,
 static int vhost_vdpa_get_vring_base(struct vhost_dev *dev,
                                        struct vhost_vring_state *ring)
 {
+    struct vhost_vdpa *v = dev->opaque;
     int ret;
 
+    if (v->shadow_vqs_enabled) {
+        VhostShadowVirtqueue *svq = g_ptr_array_index(v->shadow_vqs,
+                                                      ring->index);
+
+        /*
+         * Setting base as last used idx, so destination will see as available
+         * all the entries that the device did not use, including the in-flight
+         * processing ones.
+         *
+         * TODO: This is ok for networking, but other kinds of devices might
+         * have problems with these retransmissions.
+         */
+        ring->num = svq->last_used_idx;
+        return 0;
+    }
+
     ret = vhost_vdpa_call(dev, VHOST_GET_VRING_BASE, ring);
     trace_vhost_vdpa_get_vring_base(dev, ring->index, ring->num);
     return ret;
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

SVQ is able to log the dirty bits by itself, so let's use it to not
block migration.

Also, ignore set and clear of VHOST_F_LOG_ALL on set_features if SVQ is
enabled. Even if the device supports it, the reports would be nonsense
because SVQ memory is in the qemu region.

The log region is still allocated. Future changes might skip that, but
this series is already long enough.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost-vdpa.c         | 39 +++++++++++++++++++++++++++++++++++----
 include/hw/virtio/vhost-vdpa.h |  1 +
 2 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static bool vhost_vdpa_one_time_request(struct vhost_dev *dev)
     return v->index != 0;
 }
 
+static int vhost_vdpa_get_dev_features(struct vhost_dev *dev,
+                                       uint64_t *features)
+{
+    int ret;
+
+    ret = vhost_vdpa_call(dev, VHOST_GET_FEATURES, features);
+    trace_vhost_vdpa_get_features(dev, *features);
+    return ret;
+}
+
 static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
                                Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_init_svq(struct vhost_dev *hdev, struct vhost_vdpa *v,
         return 0;
     }
 
-    r = hdev->vhost_ops->vhost_get_features(hdev, &dev_features);
+    r = vhost_vdpa_get_dev_features(hdev, &dev_features);
     if (r != 0) {
         error_setg_errno(errp, -r, "Can't get vdpa device features");
         return r;
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_mem_table(struct vhost_dev *dev,
 static int vhost_vdpa_set_features(struct vhost_dev *dev,
                                    uint64_t features)
 {
+    struct vhost_vdpa *v = dev->opaque;
     int ret;
 
     if (vhost_vdpa_one_time_request(dev)) {
         return 0;
     }
 
+    if (v->shadow_vqs_enabled) {
+        if ((v->acked_features ^ features) == BIT_ULL(VHOST_F_LOG_ALL)) {
+            /*
+             * QEMU is just trying to enable or disable logging. SVQ handles
+             * this sepparately, so no need to forward this.
+             */
+            v->acked_features = features;
+            return 0;
+        }
+
+        v->acked_features = features;
+
+        /* We must not ack _F_LOG if SVQ is enabled */
+        features &= ~BIT_ULL(VHOST_F_LOG_ALL);
+    }
+
     trace_vhost_vdpa_set_features(dev, features);
     ret = vhost_vdpa_call(dev, VHOST_SET_FEATURES, &features);
     if (ret) {
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_set_vring_call(struct vhost_dev *dev,
 static int vhost_vdpa_get_features(struct vhost_dev *dev,
                                      uint64_t *features)
 {
-    int ret;
+    struct vhost_vdpa *v = dev->opaque;
+    int ret = vhost_vdpa_get_dev_features(dev, features);
+
+    if (ret == 0 && v->shadow_vqs_enabled) {
+        /* Add SVQ logging capabilities */
+        *features |= BIT_ULL(VHOST_F_LOG_ALL);
+    }
 
-    ret = vhost_vdpa_call(dev, VHOST_GET_FEATURES, features);
-    trace_vhost_vdpa_get_features(dev, *features);
     return ret;
 }
 
diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/vhost-vdpa.h
+++ b/include/hw/virtio/vhost-vdpa.h
@@ -XXX,XX +XXX,XX @@ typedef struct vhost_vdpa {
     bool iotlb_batch_begin_sent;
     MemoryListener listener;
     struct vhost_vdpa_iova_range iova_range;
+    uint64_t acked_features;
     bool shadow_vqs_enabled;
     /* IOVA mapping used by the Shadow Virtqueue */
     VhostIOVATree *iova_tree;
-- 
2.7.4